Privacy Policy

Data Controller

This Privacy Policy explains the personal data processing activities carried out by Berkuubik MB, company code 308012954 (“Berkuubik”, “Company”, “we”, “us”, or “our”), in relation to the use of www.berkuubik.com and the digital transformation and software solutions we provide.

These solutions may include applications, website products, software, technical support, and other services provided under contractual relationships (together, the “Services”).

As a software solution provider, we may provide commercial clients with products that support their digital transformation and business requirements. Those products may be used by our clients to collect or process the personal data of their own end-users.

Purposes for Processing Personal Data

We may collect and process personal data for the following purposes:

• To advertise, market, and publicise our products and Services, including information about new products, relevant services, special offers, newsletters, and client-satisfaction surveys.
• To respond to enquiries, requests, questions, or complaints.
• To provide our clients and, where relevant, their end-users with the Services and related technical support.
• To form, manage, and perform contracts with our clients, including processing contact details of authorised employees and representatives.
• To support business and product development, including analysis of the use of our applications, website, and software.
• To diagnose technical problems, maintain security, and improve the reliability and performance of our products and website.
• To send business-related communications, including messages concerning payments, contracts, renewals, or service changes.
• To carry out market research and better tailor our Services to the needs and expectations of our clients.
• To protect our rights and interests and those of our clients, including preventing fraud, piracy, misuse, and other unlawful conduct.
• To meet legal, regulatory, tax, accounting, reporting, record-keeping, and archiving obligations.
• To respond to lawful requests from courts, law-enforcement bodies, regulators, and other authorised public authorities.

Recipients of Personal Data and International Transfers

We may share personal data with business partners, suppliers, professional advisers, legally authorised public institutions, and authorised private persons where necessary for the purposes described in this Privacy Policy.

• Information technology, hosting, cloud, communications, analytics, security, and technical-support providers that help us deliver and maintain the Services.
• Public authorities and law-enforcement bodies where disclosure is required by law or necessary to respond to a lawful request.
• Courts, enforcement offices, legal advisers, debt-collection providers, and other parties where necessary to establish, exercise, defend, or protect legal claims and interests.
• Parties involved in a merger, acquisition, restructuring, financing, sale of assets, or transfer of all or part of our business or Services.

Where personal data is transferred outside the European Economic Area or otherwise to a third country, we will use the transfer mechanisms and safeguards required under applicable data protection law.

How We Collect Personal Data and Our Legal Bases

We may collect personal data through electronic and physical channels, including:

• Our website, including contact forms and tracking technologies such as cookies.
• Mobile applications, software products, and technical-support systems.
• Email correspondence and other communication channels.
• Our social-media accounts and business profiles.
• Contracts, written forms, invoices, legal documents, and other materials provided during a business relationship.

Further information about cookies and similar technologies should be provided in our separate Cookie Policy.

We process personal data only where at least one lawful basis applies. Depending on the circumstances, we may rely on:

• Contract: processing is necessary to enter into or perform a contract.
• Legal obligation: processing is necessary to comply with a legal or regulatory requirement.
• Legitimate interests: processing is necessary for our legitimate business interests, including serving clients, improving the Services, managing the business, protecting systems, and marketing relevant services where permitted.
• Legal claims: processing is necessary to establish, exercise, protect, or defend our rights.
• Consent: processing is based on your freely given consent where consent is required.

Your Rights

Subject to the GDPR and other applicable data protection laws, you may have the following rights:

• Right to be informedTo receive clear, transparent, and understandable information about how we process your personal data.
• Right of accessTo request confirmation of whether we process your data and to receive a copy of the relevant personal data.
• Right to rectificationTo request correction or completion of inaccurate or incomplete personal data.
• Right to data portabilityWhere processing is based on consent or contract and is carried out by automated means, to receive your data in a structured, commonly used, and machine-readable format.
• Right to erasureTo ask us to delete personal data where there is no longer a lawful reason for retaining or processing it.
• Right to restrict processingTo request that we limit the use of your personal data in certain circumstances.
• Right to objectTo object to processing based on legitimate interests and to object at any time to direct marketing.
• Right to withdraw consentWhere processing is based on consent, to withdraw that consent at any time without affecting processing already carried out.

We will normally respond within 30 calendar days after receiving a valid request. Where permitted by the GDPR, this period may be extended by a further 60 calendar days due to the complexity or number of requests. We will inform you of any extension and the reasons for it within the initial 30-day period.

We may request information necessary to verify your identity. Where a request is manifestly unfounded, excessive, or repetitive, or where a legal exception applies, we may refuse the request or charge a reasonable fee. Any refusal will be explained in writing.

How Long We Keep Your Personal Data

We will keep your personal data for as long as it is needed for the purposes for which your data was collected and processed, but not longer than required by applicable laws and regulations, including to comply with legal, regulatory, tax, accounting, or reporting obligations. If the legislation of the Republic of Lithuania does not provide an applicable data-retention period, we will determine it by taking into account the legitimate purpose of retention, the legal basis, and the principles of lawful processing of personal data. Personal data that is important for the contractual relationship between you and the Company is normally stored for as long as the contractual relationship lasts and for a maximum of 10 (ten) years thereafter.

If you do not enter into a contract with us, personal data is normally stored for a maximum of 12 months. We may retain your personal data for a longer period when:

1. it is necessary for the Company to defend itself against existing or threatened claims, exercise its rights, or properly resolve a dispute, complaint, or claim;
2. there is a suspicion of illegal activity;
3. it is required by applicable laws.

Upon expiration of the retention period, we will delete and/or reliably and irrevocably depersonalize your data as soon as possible, within a reasonable time required to perform such action.

Marketing Consent

Where consent is required for marketing communications, the following wording may be used:

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.