This Privacy Policy provides information about the processing of personal data by the companies which belong to the MV GROUP group of companies – how they collect, process, and store personal data. We understand the importance of personal data protection, therefore we respect the privacy of our clients and other data subjects (hereinafter referred to as Data Subjects) and protect personal data.
MV GROUP group of companies consists of MV Group Distribution, UAB; MV GROUP Production, AB; MV GROUP Asset Management, UAB; MV GROUP, UAB; MV GROUP Logistics,UAB; and other companies (information about all companies of the Group is available at www.mvgroup.eu/en/contacts), hereinafter all MV GROUP group of companies are collectively referred to as MV GROUP, and each individually as the Company or the Data Controller.
The Controller of your personal data is the company of the MV GROUP of companies, to which you have provided your personal data in connection with the contractual relationship between you or the services of which you (or the legal entity which representative you are) intend to use, use and/or which determines the purpose and means of processing of personal data.
1. The purposes, categories and legal bases of the processing of personal data
1.1. Conclusion and performance of contracts with clients, compliance with accounting requirements
| Legal basis for data processing | Data categories |
| Performance of the contract (Art. 6 GDPR) 1 (b) compliance with legislative requirements (Art. 6 GDPR) 1 (c) | Conclusion and performance of contracts with clients (natural and legal persons):name, surname, position, e-mail address and/or phone number of the client, his/her employee or representative, date of birth or national identification number, requests related to the provision of services. For the purpose of conclusion and performance of contracts with natural persons, other personal data may additionally be processed. The categories of personal data of the client, which are processed in a specific case, depend on the nature of the contract concluded and performed. In any case, only as much personal data is processed as it is necessary for the performance of a contract or for the proper compliance with the legislative requirements. Compliance with accounting requirements: Personal data such as name, surname, address and other data are processed when invoicing, if the client so requests. While administering the received invoices, the personal data that must be provided in accordance with the requirements provided for in legislation shall be processed. |
1.2. Direct marketing and participation in loyalty programs
| Legal basis for data processing | Data categories |
| Consent (Article 6(1)(a) of the GDPR) or Legitimate interests (Article 6(1)(f) of the GDPR) (subject to the conditions set out in the Electronic Communications Act) | Name, surname, date of birth, address, city, phone number, email address, and other data. There is processed the information about the goods purchased by the clients, information about the time of purchase and delivery, the amount of purchase, the method, the frequency of purchase, when the information about the content of direct marketing is provided to the participants of the loyalty program or when the person agrees to receive information about the offers intended for the participants of the loyalty programs. Detailed information on the categories of personal data processed is provided in the Privacy Policy of Bottlery (www.bottlery.eu), the Privacy Policy of Nespresso (www.nespresso.eu). If you have consented to receive offers and newsletters, we process your personal data to provide you with such offers and information, e.g. general newsletters; information about our and our partners offers, discounts, promotions, sales; inviting you to take part in promotions, games and to win prizes; asking you for opinion about our services and products; etc. We provide offers and information in the ways you choose: e.g. by emails, SMS. At any time you may refuse receiving offers and news. |
1.3. Processing of personal data of shareholders, beneficiaries, management bodies, other bodies and their members for the purposes of internal management and the fulfillment of legal obligations
| Legal basis for data processing | Data categories |
| Compliance with legislative requirements (Art. 6 GDPR) 1 (c) | While performing duties related to the provision of information on final beneficiaries, the following personal data of shareholders and company managers are processed in the JANGIS subsystem of State enterprise Centre of Registers: name, surname, national identification number. In this case, the following personal data of the final beneficiaries are processed either: the name of the state, the name (s) of the country (ies) of residence for tax purposes, the ownership and/or control rights of the beneficiary and their scope. In the case of an indirect beneficiary, the data of all legal entities through which the legal entity is controlled are processed: name, legal entity code, legal form, registered office, available property rights and their scope. |
The legal obligations related to the management of the Company and other bodies include their formation, organization of their activities, submission of data of the management bodies of the Company and their members to public registers and registration, compliance with other legal requirements.
1.4. Performance of e-commerce
| Legal basis for data processing | Data categories |
| Performance of the contract (Art. 6 GDPR) 1 (b) | Name, surname, e-mail address, mobile phone number, delivery address, signature of the person picking up the goods, date and time of the purchase and delivery, names of the goods, quantities, purchase prices and discounts granted, method of payment for purchases and payment information. Detailed information on the categories of personal data processed is provided in the Privacy Policy of Bottlery (www.bottlery.eu), the Privacy Policy of Nespresso (www.nespresso.eu). |
1.5. Video surveillance in order to protect property
| Legal basis for data processing | Data categories |
| Legitimate interest in protection of the property (Art. 6 GDPR) 1 (f) | Video recordings in which persons entering the field of video surveillance are captured |
1.6. Handling and processing of requests and complaints
| Legal basis for data processing | Data categories |
| Performance of the contract (Art. 6 GDPR) 1 (b) compliance with legislative requirements (Art. 6 GDPR) 1 (c) | Name, surname, phone number, e-mail address, address of the place of residence, date of birth, content of the request: the event for which the request is made, its circumstances, date, place, your application, claim or feedback, a product, other information provided in the request; other documents and/or data provided with the request: e.g. data of the purchase receipt, photos. |
1.7. Recording of events in photos and videos
| Legal basis for data processing | Data categories |
| Consent (Art. 6 GDPR) 1 (a) performance of the contract (Art. 6 GDPR) 1 (b) or legitimate interests in disseminating information about the activities of the company (Art. 6 GDPR) 1 (f) | Photos, videos of the people participating in events organized by MV GROUP group of companies |
We process your personal data in order to disseminate information about the activities of our company, to provide you the opportunity to participate in our events and to use the results or products.
We process personal data when you participate in events or other activities in our shops or other places. In order to avoid the possibility of being photographed or filmed, participants of events organized by the MV GROUP group of companies may not participate in them or otherwise clearly express their disagreement.
1.8. Organization and administration of events
| Legal basis for data processing | Data categories |
| Consent (Art. 6 GDPR) 1 (a) performance of the contract (Art. 6 GDPR) 1 (b) compliance with legislative requirements (Art. 6 GDPR) 1 (c) or legitimate interests (Art. 6 GDPR) 1 (f) | Personal data of the participants, to the extent necessary in relation to the purpose and legislative requirements, photos and videos containing participants of events |
1.9. Organization and administration of games, contests, and promotions
| Legal basis for data processing | Data categories |
| Consent (Art. 6 GDPR) 1 (a) performance of the contract (Art. 6 GDPR) 1 (b) compliance with legislative requirements (Art. 6 GDPR) 1 (c) or legitimate interests (Art. 6 GDPR) 1 (f) | Name, surname, contact details, an account name of social networks, account data of social networks, age, other personal data of participants, as far as it is necessary considering the purpose and legislative requirements. |
When organizing and administering games and promotions, personal data of participants are processed. When fulfilling accounting requirements, please provide personal data in the documents confirming the withdrawal of prizes. If necessary, we will process personal data of game participants for the purpose of defending interests in court or other institutions.
1.10. Selection for job position(s) or trainees and evaluation of candidacy, administration of database of job applicants (trainees) and providing job offers
| Legal basis for data processing | Data categories |
| Consent (Art. 6 GDPR) 1 (a) | Name, surname, date of birth, data on place of residence, e-mail address, phone number, information about work experience, education, qualification upgrading, competences, other information that the job applicant provides in his/her resume (CV), motivation letter (if provided) or feedback from employers about the job applicant (trainee) or recommendations in other application documents of person applying for a job: the person who provides the feedback or recommendation, his/her contact details, the content of the feedback or recommendation, information about the evaluation, other information, to the extent it is necessary during the selection process for a specific job position and to the extent permitted by applicable legislation. |
We receive the personal data of job applicants (trainees) from the job applicant (trainee) or from recruitment agencies, job search online portals and/or other entities providing job search, selection and/or mediation services.
1.11. Recovery of debts in the event of default
| Legal basis for data processing | Data categories |
| Legitimate interests of the Data Controller to recover debts (Art. 6 GDPR) 1 (f) | Personal data of debtors, representatives of legal entities: name, surname, address, phone number and e-mail address. |
1.12. Promotion of awareness on social networks
The information that you provide on the Facebook or LinkedIn account of the MV GROUP group of companies or the Company which belongs to it (including messages, the use of the “Like” and “Follow” and other communications) or that is received when you visit these accounts on Facebook or LinkedIn networks is controlled by the administrator of the social network, therefore we recommend that you read the privacy notices of the administrators of social networks. When administering an account, the MV GROUP group of companies or the Company which belongs to it selects the appropriate settings, considering the target audience and the objectives of the management and promotion of the activity. The administrator of the social network may have limited the ability to change certain settings by providing the opportunity to create an account, and thus we cannot influence what information the administrator of the social network will collect about you.
Generally, the administrator of the social network processes your personal data for the purposes determined by the administrator of the social network, based on the privacy policy of the administrator of the social network. However, when you use the social network, communicate with the MV GROUP group of companies or the Company which belongs to it on the social network, visit the account on the social network or follow posts on it, the Company receives information about you. The amount of data received depends on the account settings we have chosen, agreements with the administrator of the social network regarding the ordering of additional services, cookies set by the administrator of the social network.
Privacy Policy of LinkedIn: https://www.linkedin.com/legal/privacy-policy
Privacy Policy of Facebook: https://www.facebook.com/privacy/policy
| Legal basis for data processing | Data categories |
| Legitimate interests to promote awareness (Art. 6 GDPR) 1 (f) the consent (Art. 6 GDPR) 1 (a) | Messages, “Like”, “Follow”, other information provided on profiles in social networks. |
1.13. Use of cookies
Cookiesare small text files that are automatically created when you browse our website and are stored on your device (a computer or a mobile). Cookies are used to make website work or function better and more efficiently.
Detailed information on the use of cookies is providedin the Cookie Policy of the website.
1.14. Processing of personal data for other purposes
The companies which belong to the MV GROUP group of companies may also process personal data for other purposes, which are specified in the Privacy Policy provided on the website of the respective Company which belongs to the MV GROUP group of companies.
Similarly, for each specific purpose, the Company which belongs to the MV GROUP group of companies may process different categories of personal data than specified in this Privacy Policy. In this case, priority is given to the information provided in the privacy policy of the relevant Company which belongs to the MV GROUP group of companies.
2. Where do we receive personal data from and in what cases do we transfer your personal data?
In most cases, personal data is provided directly by the Data Subject. In some cases, we may receive personal data from third parties such as recruitment agencies, job search online portals and/or other entities providing job search, selection and/or mediation services.
Your personal data may be provided to state and municipal institutions and other persons performing the functions assigned to them by law, if such an obligation is provided for in legislation. We transfer your personal data upon request or in order to pursue our legitimate interest in asserting, enforcing or defending legal claims.
Transfer of personal data for the purpose of direct marketing, e-commerce and participation in loyalty programs
In cases where it is necessary for us to implement the respective purposes, your personal data may be transferred to the following third parties:
- other entities of the MV GROUP, when they perform the functions necessary for the fulfilment of the relevant purpose;
- third parties which help us run and administer the loyalty program (for example, companies providing services of advertising and organization of events and games; companies providing newsletters sending services; companies providing software maintenance and support services). In each case, we only provide the data to the data processor to the extent necessary for the execution of a specific order or for the provision of a specific service. The data processors employed by us can process your personal data only according to our instructions and cannot use them for other purposes or transfer them to other persons without our consent. In addition, they must ensure the security of your data in accordance with applicable legislation and written agreements concluded with us;
- couriers, companies providing delivery services and their employees, when it is necessary to deliver your purchased goods;
- to other third parties, when it is necessary for the implementation of the relevant purpose, for example, competent authorities or law enforcement agencies (police or supervisory authorities, etc.), but only at their request and only when required in accordance with applicable legislation or in the cases and procedures provided for by legislation, in order to ensure our rights, the safety of our customers, employees and resources, to assert, submit and defend legal claims.
Transfer of personal data for the purposes of recruitment and evaluation of candidacy, administration of the database of job applicants and submission of job offers
We may transfer your data to third parties when this is necessary for the fulfillment of a specified purpose for which we process personal data. These may include third parties which provide us with services related to selection, evaluation of candidates and internal administration (database software providers, database administration providers, data centers, hosting and cloud service providers, etc.).
When the Company processes personal data for the purpose of selection for job position(s) or trainees, the Company may also transfer the personal data of job applicants or trainees to other companies of the group of companies to which the Company belongs, if they participate in the processes of evaluating the candidacies of management personnel or trainees. When the Company processes personal data in the applicants database for the purpose of administration, the Company may transfer the personal data of a job applicant or a trainee to other companies of the group of companies to which the Company belongs, if the candidacy of the person in question may be suitable for taking a job in these companies or doing an traineeship in these companies.
If personal data is provided in the course of selection for job position(s) in companies located abroad (in other EU countries) or in the administration of job applicants in the database of companies located abroad, they may be transferred to companies located abroad that are looking for employee(s) in job position(s).
Your personal data is processed within the framework of the European Union and the European Economic Area. However, data may be transferred outside the European Union or the European Economic Area, when such transfer is necessary for the conclusion and performance of contracts and the proper provision of services. In this case, steps are taken to ensure that any transfer of personal data outside the European Union and the European Economic Area is properly performed and that the privacy rights of data subjects are maximally protected. The transfer of personal data outside the European Union and the European Economic Area is governed by the requirements of Chapter V of the GDPR.
3. What rights does the data subject have and how can they be exercised?
You have the right to familiarize with your personal data and how they are processed, to demand correction, supplement or destruction of the provided personal data, as well as to stop their processing (cancel your consent). You also have the right to demand that the controller of personal data would restrict the processing of personal data, the right to transfer data, submit a complaint with the State Data Protection Inspectorate (contact details are available on the website www.ada.lt) and object to the processing of submitted personal data. Information about the procedure for exercising these rights is provided to the e-mail address of your personal data controller:
| Data Controller | E-mail address |
| MV Group Distribution, UAB | |
| MV GROUP Production, AB; ALITA, AB group of companies; MV GROUP Asset Management, UAB; MV GROUP, UAB | |
| MV GROUP Logistics, UAB |
4. How long do we keep personal data?
We store personal data for no longer than is required by the purposes of data processing or provided for by legislation, if they provide for a longer storage period. Personal data may be stored longer than indicated, if this is provided for in legislation or when it is necessary for the company to defend itself against demands, claims or lawsuits brought against it, as well as when personal data is needed for an investigation or as evidence in a civil, administrative or criminal proceedings.
| Purpose of data processing | Time limit for data processing |
| Conclusion and performance of contracts with clients, compliance with accounting requirements | Accounting and tax documents shall be stored on the basis of compliance with legislative requirements within the time limits provided for in the legislation. Other purchase data is stored for 5 years from the date of the purchase transaction. |
| Direct marketing and participation in loyalty programs | As long as your consent to receive offers and news is valid. We may keep the consent and proof of consent for a longer period of time if necessary to defend ourselves against claims, demands or actions brought against us. The terms applicable to Bottlery and Nespresso are set out in Bottlery‘s and Nespresso‘s privacy policies at www.bottlery.eu and www.nespresso.lt |
| Processing of personal data of shareholders, beneficiaries, management bodies, other bodies and their members for the purposes of internal management and the fulfillment of legal obligations | No longer than is required by the purposes of data processing or provided for by legislation, also considering the time limits provided for therein. |
| Performance of e-commerce | There are applied terms specified in the Privacy Policy of Bottlery and Nespresso www.bottlery.eu and www.nespresso.lt. |
| Video surveillance in order to protect property | There are applied terms specified in the Privacy Policy of Bottlery and Nespresso www.bottlery.eu and www.nespresso.lt. |
| Handling of inquiries, requests and complaints | 12 calendar months from the date of the inquiry, request or complaint. |
| Recording, organization and administration of events | In the case of events for employees, personal data is stored for 3 years from the date of consent or as long as the consent is valid. If the legal basis for the processing is the performance of a contract, the time limit for processing the data is the one provided for in the contract. When personal data is processed on the basis of legitimate interest, it is stored for as long as the employment relationship continues. For other events, photos and videos are stored for 3 years from the date of consent or as long as the consent is valid. If the legal basis for data processing is the performance of a contract, the time limit of data processing is as provided in the contract. Other personal data of the participants are stored for 6 months after the end of the event, unless another time is provided in the event notification. |
| Organization and administration of games and promotions | The data provided in the prize transfer – acceptance act is stored for 10 years from the date of signature of this act. Other personal data is stored no longer than the end of the time limit during which it is possible to appeal the game or promotion. |
| Conducting the selection for job position(s) (trainees) and evaluation of candidacy | If, when providing his/her personal data, a person indicates a job position for which he/she requests to apply or an traineeship offer that interests him/her, his/her personal data is stored until the selection for the selected job position or traineeship offer is performed. |
| Administration of the database of job applicants (trainees) and provision of job (traineeship) offers | 3 years after receiving the consent. |
| Recovery of debts in the event of default | Personal data is stored during the period of sending reminders and while the debt is being recovered, in cases when the debt is being recovered – during the validity of the contract and 10 years after the end of the contract and fulfilment of the obligations, debt recovery or issuance of a certificate that the debt is not possible to be recovered. |
| Promotion of awareness on social networks | Information about the time limits of storage of personal data is provided in the privacy policies of social networks. |
| Use of cookies | The data is stored according to the time limits specified in the cookie list. |
5. Modification of the Privacy Policy
This Privacy Policy may be updated and modified. Updates and modifications are communicated by publishing the modified text of the Privacy Policy on the website www.mvgroup.eu.
Valid from 28/03/2023
