Privacy policy

2.1. AKROPOLIS respects your privacy and seeks to ensure the security of your personal information. In doing so, and in compliance with the GDPR, the data protection requirements laid down in the legislation of the Republic of Lithuania, other directly applicable laws regulating personal data protection, as well as the guidance of supervisory authorities, AKROPOLIS applies uniform data protection standards and principles across the entire AKROPOLIS Group by implementing the AKROPOLIS Privacy Policy.

This Privacy Policy does not apply to the processing of personal data carried out by: (i) the shopping and entertainment centre AKROPOLIS Kaunas (which does not belong to our Group), except for the information set out in Section 4.1 of this Privacy Policy on the use of cookies on the subpage (access: www.akropolis.lt/kaunas/en/privacy-policy/) relating to the above-mentioned shopping and entertainment centre in Kaunas, (ii) any other company not belonging to AKROPOLIS (unless the processing of data is carried out on our behalf and we have explicitly indicated this in this Privacy Policy), or (iii) an independent data controller, such as the police, the State Tax Inspectorate, courts, etc.

3.1. When processing your data, AKROPOLIS aims, inter alia, to ensure:

3.1.1. lawfulness, fairness and transparency – to collect and process data transparently, so that you, as data subjects, are fully informed about how we process your data, to comply with all legal acts governing data protection and privacy, and to ensure the proper implementation of obligations laid down in such legislation (principle of lawfulness, fairness and transparency);

3.1.2. security – to protect your personal data in accordance with market standards and by applying appropriate technical or organisational measures to ensure the proper security of personal data (e.g., access control), including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, and to update security measures when necessary (principle of integrity and confidentiality).

3.2. When processing your personal data, we always ensure that:

3.2.1. personal data are collected only for the purposes specified in this Privacy Policy and only to the extent necessary to achieve those purposes. Personal data collected for these purposes are not and will not be processed for any other purposes incompatible with the original ones (purpose limitation principle);

3.2.2. only authorised persons bound by confidentiality obligations have access to your data and only to the extent necessary to perform specific functions (based on the need-to-know principle);

3.2.3. only accurate and correct personal data are processed. When providing us with your data, please carefully check the accuracy of the information each time and notify us as soon as possible if you notice any errors. Information on how to update your data if it changes can be found in Section 7 of this Privacy Policy;

3.2.4. personal data collected for the purposes specified in this Privacy Policy are retained only for as long as necessary to achieve those purposes and are then promptly deleted (storage limitation principle);

3.2.5. only such personal data and only to the extent strictly necessary for the purpose of the specific processing operation are processed (data minimisation principle).

3.3. You may provide us with another person’s data (for example, when submitting a request to us or filling in a form to claim a prize) only if (i) you have a legal basis for sharing such data, i.e. if that person has authorised you to share the data with us, and (ii) you have informed him/her of this Privacy Policy, the purposes and scope of data processing, and (iii) you have obtained his/her explicit consent to such provision and processing of data.

3.4. Persons providing data undertake in all cases to provide only true and accurate information.

3.5. We kindly ask you to safeguard your personal information and provide us with your data only to the minimum extent necessary to resolve your enquiry/situation.

3.6. Information on the cookies used on our Website, the data collected through them, and information automatically collected when visiting our Website is provided in more detail in the separate AKROPOLIS Cookie Policy available at www.akropolis.lt/kaunas/en/privacy-policy/.

We process your personal data for the purposes set out in this section of the Privacy Policy and on the corresponding legal bases, each of which is explained in more detail below.

PLEASE NOTE that we may not process all of the data listed under each data processing purpose in this section. The scope of data processed is determined on a case-by-case basis in line with the principle of data minimisation, which means the volume of personal data processed may be smaller than indicated.

When you visit and browse our Website, we collect data about its visitors. We carry out such processing of your personal data through cookies under the main conditions set out below.

More information about the cookies used on our Website, their management, consent to their installation and withdrawal can be found in our Cookie Policy. You can change or update your cookie preferences at any time in the Cookie Policy.

PLEASE NOTE that where the Website contains subpages and forms of UAB KAUNO AUDINIŲ PROJEKTAS (AKROPOLIS Kaunas), we act only as a technical service provider, ensuring the proper functioning of such subpages. We do not review or access the personal data provided in those subpages and forms, except where UAB KAUNO AUDINIŲ PROJEKTAS requires us to resolve technical issues in the relevant subpage and/or form. Although the Website domains belong to us, the controller of such data is the respective entity (e.g., UAB KAUNO AUDINIŲ PROJEKTAS), responsible for the purposes, content and overall GDPR compliance of the data processing applicable to it as the data controller. For our part, we are responsible only for the proper functioning of cookies on such subpages and for GDPR compliance in relation to the provision of server hosting services, and in this respect we act as a data processor for UAB KAUNO AUDINIŲ PROJEKTAS.

Video surveillance is carried out in the public areas and premises of the Shopping Centres, as well as in the public areas of the business centres located within them (i.e., lift lobbies on each floor) – meaning real-time monitoring of images transmitted by video cameras and the recording of video footage (video data processing). When you visit a Shopping Centre or its premises, you enter the field of view of the video cameras.

Before entering the surveillance area, visitors to each Shopping Centre are informed of the video surveillance by warning signs displaying a camera symbol and the necessary information about such processing of your personal data.

Such processing of your personal data is carried out under the following conditions:

In the public areas and/or premises of the Shopping Centres, as well as in the public areas of the business centres located within them, free access to a wireless internet connection (Wi-Fi) is provided. When you connect to the network and use this service we provide, the related data are processed under the following conditions:

When you call the publicly available Shopping Centre information telephone number and consent to the recording of your call, the call is recorded, and the audio data processed. Recording begins only after you have given your consent and once the Shopping Centre information centre consultant answers the call.

If you do not consent, the call will be terminated before recording begins and your personal data will not be processed – such a call is not recorded. In that case, you are invited to contact the respective Shopping Centre information centre directly or by email.

Your personal data is processed under the following conditions:

If you have chosen to subscribe to, or have otherwise agreed to receive, our newsletters (direct marketing and/or messages related to major AKROPOLIS events), we process your email data.

Your consent will remain valid for 2 years, unless you withdraw it earlier.

You may withdraw your consent to receive (subscribe to) our newsletters at any time by clicking the link provided in the received newsletter or by contacting us using the contact details below.

Provided that you have opted to receive newsletters from a specific Shopping Center(-s), you may modify your choice at any time by using the link provided in the newsletter.

Your personal data is processed under the following conditions:

When you wish to participate in our games, promotions, competitions and/or lotteries, register to play (where applicable), and when you win and seek to claim the prize/gift you have won, we process your related personal data.

Processing of your data is carried out under the following conditions:

If, when receiving a prize from our organised game/promotion/contest/lottery, you agree to be photographed and/or recorded on video and that your image may be published on the Website and/or our social media accounts as well as other public communication channels, we will process your related personal data, including your image.

Your consent will remain valid for 2 years, unless you withdraw it earlier.

You may withdraw your consent to the processing of your image at any time by contacting us using the details below. Once we receive your notification of withdrawal of consent, we will immediately cease using your photo and/or video for the purposes specified below.

Such processing of your data is carried out under the following conditions:

If, during an event in the Shopping Centre or in a specially designated photo area (such as a photo booth or by a photo wall), your (or your child’s) image is captured (for example, by a photographer engaged by us or stored in the memory of the photo booth), we will process that image.

At every event and/or other type of activation (for example, in a temporary interactive zone in the Shopping Centre, in communication initiatives, etc.) where photography and/or filming takes place, a notice board will be placed in a visible location to inform you accordingly. If details of an event in the Shopping Centre are made public (for example, on our website or on our social media accounts), this notice will also be published together with the event description, clearly separated from the terms of the event itself.

If you would like your (or your child’s) image captured in a photograph and/or video recording to be removed from the event’s photo gallery, video gallery or similar, please contact us using the details provided below. Once we receive your request, and where this is technically feasible, we will cease using your (or your child’s) photograph and/or video recording for the purposes described below.

PLEASE NOTE that if your image has been included in publicly available sustainability reports of the data controller and/or the controller’s annual reports or other similar public documents, its removal may be unduly burdensome, disproportionate, or may remain necessary to protect the legitimate interests of the controller. In such cases, if you object to the processing of your image for these purposes, we will inform you separately of the actions we take.

Such processing of your data is carried out under the following conditions:

For the purpose of managing our social networking accounts (Facebook, Instagram, YouTube, Tik Tok) and communicating with social media users, we process your personal data in connection with these activities.

Such processing of your data is carried out under the following conditions:

When you purchase an electronic version of a Gift Card or request an invoice and we need to contact you in order to deliver the electronic Gift Card or purchase documents, we process the relevant personal data.

Such processing of your data is carried out under the following conditions:

When you register to take part in fairs/markets organised by us by providing your personal data, or when you are selected as one of the participants in a fair, we process your personal data.

Such processing of your data is carried out under the following conditions:

When you leave us your feedback, enquiry, or complaint, request information about events held at the shopping centre, or contact us on other matters of concern to you via our Website (in the designated section) or through the official contact email addresses we publish (by sending a message), and provide (indicate) your personal data, we process your data.

PLEASE NOTE that for the purposes set out in this section, the processing of your personal data does not include the processing of voice call recordings when you call the publicly available information line of the shopping centre. Information on how we process your personal data in order to ensure the effective handling of voice data subjects’ notifications or enquiries, as well as, where necessary, to retain evidence for the determination or investigation of relevant events, can be found in Section 4.4 of this Privacy Policy.

We kindly ask you to provide only your first name and an email address or phone number.

Such processing of your data is carried out under the following conditions:

When you contact us (e.g. using our officially published contact details or in person) regarding an incident that has occurred in the Shopping Centre or on its premises and provide (indicate) your personal data, we process the data you provide.

We kindly ask you to protect your personal information and provide us with your data only to the minimum extent necessary to objectively assess your enquiry and provide you with a response. In addition, when contacting us for the first time, please provide only your first name and an email address or telephone number through which we can contact you.

Such processing of your data is carried out under the following conditions:

When you apply for a vacant position at AKROPOLIS or for a professional or voluntary internship and provide us with your personal data (including the data contained in the attached curriculum vitae (CV), cover letter, or information provided during a meeting, etc.), we process your data under the conditions set out below.

PLEASE NOTE that in assessing your suitability for the position, we may contact your former employers and/or educational institution (in the case of an internship) in order to enquire about your qualifications, skills, or professional attributes. We will do so on the basis of our legitimate interest to select motivated, qualified, and most suitable candidates for the specific position.

If you are selected for the proposed position and conclude an employment or internship contract with us, the recruitment data will be retained in accordance with the procedure and time limits established for the processing of personnel data, which you will be informed of at the time of concluding the contract.

When you are our existing or prospective partner (or their representative), e.g. a tenant, advertising client, supplier, consultant, etc., or you contact us on any other grounds related to the conduct of your or our business activities, e.g. submitting a press release, a cooperation proposal, etc., we process your data under the conditions set out below.

This includes any electronic communication between us via officially published general contact addresses, as well as personalised work email addresses of ours or yours (representative) (e.g. info@akropolis.lt, name.surname@akropolis.lt), completion and submission of electronic forms (e.g. Lease Application) on your or our Website, provision of data during a telephone conversation, etc.

At the business centre located in the AKROPOLIS Vilnius shopping centre, as well as in the administrative premises of the AKROPOLIS Klaipėda and Šiauliai shopping centres, access control is carried out: i) through automatic electronic gates, which open when a (personalised) electronic key is presented, or ii) through electronic door scanners, which open the door when a (personalised) electronic key is presented, or iii) by a business centre security officer verifying the data provided in advance to security regarding the person’s lawful basis to be present in the business centre at the relevant time.

Such processing of your personal data is carried out under the following conditions:

All personal data referred to in this section in relation to each of the above-mentioned purposes of personal data processing may also be processed for the purpose of establishing, exercising, or defending legal claims. For this purpose, personal data will be processed on the basis of our legitimate interest in establishing, exercising, or defending legal claims (Article 6(1)(f) of the GDPR). We will process such data for this purpose until the completion of the relevant legal proceedings (for example, the examination of a claim, or the entry into force of a court or arbitration ruling), and if a final decision is adopted by a court or another dispute resolution authority in the relevant legal proceedings – 5 years from the date of such decision.

5.1. When purchasing certain services from third parties (service providers), such as database administration, call centre service providers, software, communications, data centres, hosting, cloud service providers, professional consultants (e.g. lawyers, auditors, or accountants), etc., we may transfer your personal data to such processors/recipients. This is necessary to ensure, carry out, and/or administer the relevant services or their benefits, to obtain the necessary advice, to develop specific functionalities, and to perform other actions.

5.2. Your data may also be provided to other data controllers, including competent governmental or judicial authorities (including arbitrators, mediators, opposing parties and their lawyers, where required for judicial proceedings) or law enforcement authorities such as the police, or supervisory authorities. Please note that this is done only in cases and under procedures established by law, to authorised persons upon request, and only where required under applicable legislation or in legally defined cases and procedures, with a legal basis, for the purpose of safeguarding our rights, ensuring the safety of our visitors, employees, and assets, and for the establishment, exercise, and defence of legal claims, including cases where your personal data are transferred to debt collection companies.

5.3. We provide each relevant data processor with only the minimum personal data necessary for the provision of their services or the implementation of their functions, and only where there is a legal basis. Our engaged data processors may process your personal data only according to our instructions, may not use them for other purposes or transfer them to other parties, and must strictly comply with the confidentiality obligations binding on them and/or their representatives.

5.4. When purchasing certain services, we engage processors (recipients) established in the EU or whose data centres are located in the EU. Therefore, in the processing of your personal data, transfers of your personal data outside the EU/EEA are generally not foreseen and usually not applied, except to the extent necessary for the use of the service packages of Google LLC, Microsoft Corporation, including cloud and hosting services, the newsletter automation service provider Sendinblue SAS (trademark Brevo) and its associated companies, or Meta Platforms Inc.

5.5. Transfers of personal data to Google LLC, Microsoft Corporation, or Meta Platforms Inc. are based on the adequacy decision adopted by the European Commission on 10/07/2023 (the EU–U.S. Data Privacy Framework), which allows European companies to transfer personal data to the U.S. without breaching the GDPR requirements on international transfers. Transfers of personal data outside the EEA when the Data Controller uses the service packages of the newsletter automation service provider Sendinblue SAS (trademark Brevo) and associated companies processing personal data in the U.S. are based on the Standard Contractual Clauses prepared according to templates approved by the European Commission (Article 46 of the GDPR).

5.6. In the paragraph 5.4 above of this Privacy Policy, or if any other recipients of data referred to in the section 4 above of this Privacy Policy are located outside the EEA, your personal data will be transferred outside the EU/EEA in compliance with an adequate level of personal data protection, provided that there is a legal basis for the transfer of personal data and at least one of the following conditions applies: i) the non-EU/EEA country where the Data Recipient is established ensures an adequate level of personal data protection as determined by a European Commission decision; ii) the Data Controller or the Data Processor implements appropriate data security measures, such as the transfer of personal data on the basis of a contract that incorporates the standard clauses approved by the European Commission or other standard clauses approved in accordance with the established procedure, an approved code of conduct, or a certificate granted to the Data Recipient; iii) derogations apply, e.g., when you have explicitly consented to the transfer of personal data, the transfer of personal data is necessary for the performance of a contract concluded with you, or the transfer of personal data is necessary for the establishment, exercise or defence of legal claims, or for important reasons of public interest.

5.7. We may transfer your personal data to other natural or legal persons where this is related to and necessary for organisational changes of AKROPOLIS, e.g. transfer of AKROPOLIS shares, assets or part thereof, and for this purpose carrying out legal due diligence of AKROPOLIS (to representatives of potential acquirers, auditors, etc.) or transferring the relevant data to the acquirer. Data may also be transferred to other natural and/or legal persons only to the extent necessary to ensure proper implementation of the personal data processing purposes set out in this Privacy Policy.

5.8. A specific list of recipients (including processors) is provided in Section 4 of this Privacy Policy, depending on the circumstances of your data processing. Accordingly, your personal data may be transferred to the recipients listed in this section for any of the purposes of data processing described in Section 4, depending on the specific situation.

6.1. To protect your privacy and data, we apply various technical and organisational measures to safeguard your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or use, as well as against all other unlawful forms of processing, including but not limited to:

6.1.1. regularly updating and testing our security technologies;

6.1.2. granting access to your personal data only to authorised employees. To ensure the privacy and security of your information, we regularly provide training to our employees on data protection and the importance of confidentiality;

6.1.3. using encryption solutions to protect sensitive information;

6.1.4. implementing procedures to ensure that suspected data security breaches are properly investigated and that measures are taken to protect your data;

6.1.5. adopting and carefully applying this Privacy Policy and other related procedures, with the overall aim of processing personal data strictly in compliance with applicable legal requirements and ensuring secure data processing.

6.2. Although we strive to protect the personal data we process, please understand that we cannot ensure or guarantee the security of any information you transmit to us, as nowadays no method of data transmission or storage is 100% secure.

7.1. As a data subject, you have the right to contact us regarding any questions relating to the processing of your personal data. You have the following rights in relation to your personal data processed by us:

7.1.1. Right to be informed about the processing of your data. You have the right to receive information about the processing of your personal data in a transparent, understandable, and easily accessible form, in clear and plain language. This is provided for in this Privacy Policy. If any part of this Privacy Policy is unclear to you, we kindly invite you to contact us using the contact details provided in Section 4.

7.1.2. Right of access to your personal data. You also have the right to obtain our confirmation as to whether your personal data are being processed, and, where that is the case, to access information about how we process your personal data, including the right to receive a copy of such data.

7.2. Right to request erasure of your data (“right to be forgotten”). You have the right to request that we erase your personal data where there is no justified reason for us to continue processing them, where the personal data are no longer necessary for the purposes for which they were collected or processed, you withdraw the consent on which the processing was based and there is no other legal basis for processing, or in other circumstances laid down in Article 17 of the GDPR. PLEASE NOTE that Article 17(3) of the GDPR provides exceptions to the above, where processing of personal data remains necessary. If such exceptions apply in your case, we will inform you accordingly;

7.3 Right to request rectification of inaccurate or incomplete data. You have the right to request that AKROPOLIS correct or supplement inaccurate or incomplete personal data concerning you. PLEASE NOTE that this right does not apply to a request to amend inaccurate personal data relating to you that have been recorded in video and/or audio footage. Such recorded data cannot objectively be altered.

7.4. Right to request restriction of processing. You have the right to request that we restrict (suspend) the processing of your personal data if you contest the accuracy of the personal data – until their accuracy is verified; the processing is unlawful, and you object to the erasure of the personal data and instead request restriction of their use; we no longer need the personal data for the purposes of processing, but you require them in order to establish, exercise, or defend legal claims; or you object to the processing of your personal data under the procedure set out below – until it is verified whether our legitimate grounds override your legitimate grounds. Where processing of personal data is restricted, such personal data may (except for storage) be processed only with your consent or only for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

7.5. Right to object. You have the right to object at any time to the processing of your personal data where such processing is carried out for the performance of a task carried out in the public interest or on the basis of our legitimate interest. In this case, we will no longer process your personal data unless we can demonstrate legitimate grounds for processing your personal data which override your interests, rights and freedoms, or are necessary for the establishment, exercise or defence of legal claims.

7.6. Right to withdraw consent. Where personal data are processed on the basis of your consent, you have the right to withdraw your consent at any time (without affecting the lawfulness of processing based on consent prior to its withdrawal), except where there are legitimate grounds for such processing or where the processing is necessary for the establishment, exercise, or defence of legal claims.

7.7. Right to data portability. You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, as well as the right to transmit those data to another controller, where the processing is based on consent or contract, and the processing is carried out by automated means. You also have the right to request that we transmit your personal data directly to another controller, where technically feasible.

7.8. Right to lodge a complaint with a supervisory authority. If you believe that your personal data are being processed unlawfully or that your rights are being infringed, you have the right to lodge a complaint with the State Data Protection Inspectorate – State Data Protection Inspectorate, L. Sapiegos g. 17, 10312 Vilnius, tel. (370 5) 271 2804, 279 1445, Fax (370 5) 271 2804, 279 1445, Fax (370 5) 261 9494, Email: ada@ada.lt). For more information, visit www.ada.lt. Before lodging a complaint with the supervisory authority, we would appreciate it if you contacted us to raise the issues of concern to you. We will make every effort to resolve your issue promptly and carefully.

7.9. To exercise your rights or if you have other questions related to the processing of your data, you can contact us:

i) Tel.: +370 65923632, ii) Email: privatumas@akropolis.lt, or iii) Postal address: Ozo g. 25, LT-07150 Vilnius. Please address your letter to: UAB AKROPOLIS GROUP, Data Protection Officer.

When contacting us, please indicate the requester and the subject matter and/or circumstances of the enquiry. We will respond to your enquiry as soon as possible, but no later than within 1 month of receipt of your request. However, taking into account the complexity, nature, and scope of the information requested, or the number of your requests, we may extend this period by a further 2 months. We will inform you of this by the end of the first month and indicate the reasons for such an extension.

8.1. This Privacy Policy is subject to ongoing review and may be amended unilaterally at our discretion.

8.2. This Privacy Policy was last updated (latest valid version from): [] [] 2025 .

8.3. We will inform you of any amendments to the Privacy Policy by changing the publication date in its preamble on our Website, and, where necessary, in the case of material amendments to this Privacy Policy, by other means, e.g. by using the email address you have provided to us.

8.4. We always post the current version of our Privacy Policy on our Website a www.akropolis.lt/kaunas/en/privacy-policy/.

8.5. You can always obtain previous versions of this Privacy Policy by contacting us at the contacts specified in Section 4 of this Privacy Policy, according to the specific personal data processing operation relevant to you.