Last reviewed and updated: 15th of September 2026
This Privacy Policy applies when you (hereinafter, “You”, “Your”), when downloading and using the mobile app AKROPOLIS, also registering for and participating in AKROPOLIS Loyalty Program DŽIAUGSMAS, provide AKROPOLIS GROUP, UAB (hereinafter, the “Company”, “AKROPOLIS”, “our”, “we” and “us”) with Your personal data and give us a possibility to process it in the scope, ways and for the purposes provided for in this Privacy Policy and the Rules (Rules) of the Loyalty Program DŽIAUGSMAS (Program or Loyalty Program).
The controller of Your Personal Data and its contact details:
AKROPOLIS GROUP, UAB
Legal entity code: 302533135
You can contact us on all matters in connection with the processing of Your Personal Data as follows:
Tel.: +370 65923632
E-mail (Data Protection Officer): privatumas@akropolis.lt
Postal address: Ozo g. 25, LT-07150 Vilnius.
Address the letter as follows: To the Data Protection Officer of AKROPOLIS GROUP, UAB.
The purpose of this Privacy Policy is to provide information about when and how we, in the context of the Loyalty Program, process Your personal data: how we receive it, on what basis and for what purposes we use it, how we use it, how long we store Your personal data, whom we share it with, how we ensure Your personal data protection, also what rights You have in this context. We respect Your privacy and seek to protect Your personal data.
It is important that You carefully read this Privacy Policy before downloading the Mobile App AKROPOLIS and creating Your Loyalty Program account in the Mobile App, as each time You use our services or provide us with personal data otherwise, You must get familiar with the terms and conditions described in this Privacy Policy.
The Privacy Policy is not intended to obtain Your consent to its provisions – it is provided to ensure that You are properly informed about the processing of Your personal data. However, certain data processing is necessary for the operation and functionality of the Program. Therefore, if You choose not to use the App or if certain data processing practices are not acceptable to You, we will unfortunately not be able to offer You participation in the Loyalty Program DŽIAUGSMAS or provide its benefits. In such a case, You may at any time delete both Your account and the App.
This Privacy Policy can be amended, updated by us, therefore, we recommend that You reread it from time to time in order to get familiar with the latest version of the document. The current version of the Privacy Policy of the Loyalty Program can always be found on AKROPOLIS website at https://akropolis.lt/vilnius/dziaugsmas/, https://akropolis.lt/siauliai/dziaugsmas/, https://akropolis.lt/klaipeda/dziaugsmas/ and in the Mobile App. If we make material changes to the Privacy Policy (e.g. related to new data processing purposes, additional categories of data, or data recipients), we will inform You separately, for instance via the App or by other appropriate means, so that You have the opportunity to review such changes before continuing to use the App.
PLEASE NOTE that in the context of the Loyalty Program, the services provided by AKROPOLIS can be used only by persons of 16 years of age and older. The Company does not collect personal data of persons under the age of 16, as this is not our target audience in relation to the processing of personal data. Therefore, if You are younger than 16, You cannot i) download and install the Mobile App on Your smart device; ii) register for and create a Loyalty Program account; iii) provide us with any personal information necessary for or related to participation in the Program.
Below, by relevant category, You will find the following information in this Privacy Policy:
| Personal Data or personal data or data: | Any information, which is related to a natural person who is or can be directly or indirectly identifiable. Separate pieces of information that, if combined, can also help identify a particular person, also constitute personal data. |
|---|---|
| You and Your: | All natural persons at least 16 years of age who download and install the Mobile App AKROPOLIS on their smart device and/or register in it by creating their personal Loyalty Program profile and, accordingly, participate in the Loyalty Program DŽIAUGSMAS by becoming its members. |
| Loyalty Program or Program: | Our Loyalty Program titled DŽIAUGSMAS, operating in all the Shopping Centres. Information about the rules and conditions applicable to the Loyalty Program and Your participation in it is available in the separate Rules of the Loyalty Program that You can access on AKROPOLIS website at https://akropolis.lt/vilnius/dziaugsmas/, https://akropolis.lt/siauliai/dziaugsmas/, https://akropolis.lt/klaipeda/dziaugsmas/ and in the Mobile App. |
| Mobile App or App: | The mobile app AKROPOLIS (in Lithuania), by use of which You can control the Loyalty Program functionalities and/or use the benefits of the Program. |
| Services or services: | Services provided by AKROPOLIS in the Mobile App and services related to the Loyalty Program collectively or, when specified so, individually. |
| Shopping Centre or SC: | All of the following shopping and entertainment centres collectively or, where the context so requires and/or where it is indicated otherwise, any of them: AKROPOLIS Vilnius, AKROPOLIS Klaipėda and AKROPOLIS Šiauliai, including the entire territory of the relevant shopping centre and any premises of common use and public spaces (as well as the Business Centre premises if applicable). |
| GDPR: | Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation). |
| EEA: | European Economic Area. |
| EU: | European Union. |
Other concepts used in the Privacy Policy are in line with the concepts used in the Rules.
When You are using the App and take part in the Loyalty Program, we:
The Loyalty Program is accessible only in AKROPOLIS Mobile App – all features of the Program, all offers, accumulation of points, prizes and other loyalty benefits are accessible only after one downloads and installs the App in one's smart device, also registers a personal account of the Program participant (see section 3.2).
Meanwhile, certain functionalities of the Mobile App can also be used without registration as a participant of the Loyalty Program (without creating a personal participant’s account). Unregistered users can only see a limited portion of the App’s information and use only some of the App’s features, such as viewing news, opening hours, layout of a Shopping Centre, following their preferred shops, and so on.
When You install and use the App (whether or not You have a registered Loyalty Program account), to ensure the proper functioning of the App, improve existing and offer new functionalities, provide content relevant to You, e.g. according to shops You opted to follow, etc., we use the so-called event tracking, i.e. we record Your certain actions in the App, e.g. logins, App screen views, giving/withdrawal of consents, clicks (e.g. “follow”/“unfollow” a shop(s), “collect the prize”, etc.).
It is only after the registration of the Loyalty Program account (see section 3.2) that Your user actions in the App are linked to the information in Your account profile. Information collected prior to the account registration shall never be linked to Your account and participant's information.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing No. 1 | To ensure the operation, security, and administration of the App, including its technical functionality, security, business continuity, error prevention, guest mode functionality, and core features available to both registered and unregistered users. |
|---|---|
| Data subjects | Users of the Mobile App who have installed it on their smart device (both registered and unregistered). |
| Data sources | We obtain Personal Data directly from You and/or based on Your use the App’s services. |
| Legal basis for data processing | Legitimate interest in ensuring the proper functioning and stability of the App (Article 6(1)(f) GDPR). |
| Data processed | Technical data: device ID, device model, operating system version, version of the App used. User identifier assigned by the system: For non-registered accounts, guest’s anonymised ID. For registered accounts, user ID. |
| Data retention period | For non-registered accounts, as long as the App is installed and used in Your device. For registered accounts, until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Emplate. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
| Purpose of data processing No. 2 | Improvement of the App and analysis of general usage statistics (without individual profiling, as described in section 7 of this Policy). |
|---|---|
| Data subjects | All App users. |
| Data sources | Personal data is obtained based on Your use of the App’s services (e.g. logins, screen views, button clicks, etc.). |
| Legal basis for data processing | Legitimate interest in analysing and improving services (Article 6(1)(f) GDPR). |
| Data processed | Technical data: device ID, device model, operating system version, version of the App used. User identifier assigned by the system: For non-registered accounts, guest’s anonymised ID. For registered accounts, user ID. Other data collected for analysis purposes: information about Your actions in (use of) the Mobile App, e.g., App login data, total number of logins and other data, settings, permissions, change of preferences, other actions You perform in the App. |
| Data retention period | For non-registered accounts, as long as the App is installed and used in Your device. For registered accounts, until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
PLEASE NOTE that in the App settings You can choose whether to allow or disallow the transfer of Your data to third-party advertising networks (Google Inc. and/or Meta Platforms Inc.). You can do this directly in the App by selecting “More”, then “Profile settings” and “Sharing with third parties”, and marking/unmarking a relevant consent in the window that opens.
If this setting has not been selected or enabled by You, it will be considered that You do not consent to the sharing of data with advertising networks, and such data sharing will not be carried out.
Only registered participants of the Loyalty Program have a possibility to make use of all functionalities of the Program and, accordingly, of the Mobile App, i.e. only persons who registered in the App and created their personal account of a Program participant. It is only after the creation of an account and logging in to it that the customers will get a possibility to accumulate points and to exchange them for prizes and other benefits of the Program, to take personal offers and make use of any other opportunities that the Program provides.
3.1.1. registering with Your e-mail address;
or
3.1.2. using Your Facebook account;
or
3.1.3. using Apple account (applicable only in case of Apple smart devices).
PLEASE NOTE that the scope and nature of Your personal data that we collect and process will depend on the selected account registration method.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing | To register You as a participant of the Loyalty Program and administer the Loyalty Program account You created. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You or from Facebook social network or Apple account (if You take a relevant option to register). |
| Legal basis for data processing | Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. |
| Data processed | Technical data: device ID. Data required for Your login authentication: phone number, password You created. Account profile data: Registration by e-mail address: Your name, surname (if applicable within the e-mail address), e-mail address, user ID. Registration by Facebook account: Your name and surname (title) indicated in Your Facebook account, unique Facebook user ID identifier, profile photo, e-mail address. Registration by Apple account: Your name and surname indicated in Your Apple account, e-mail address or Apple-generated private e-mail address and unique Apple ID user identifier. Other additional information that You choose to give us: For example, date of birth, gender, postal code, interests and/or consumption habits. |
| Data retention period | Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
By participating in the Loyalty Program, You have the opportunity to actively engage in various loyalty actions – to accumulate points, use special offers and exclusive benefits, which are intended only for registered participants of the Program. As You accumulate points, use special offers and the opportunities provided by the Loyalty Program, including to play loyalty games, take part in events or promotions, in order to fulfil our loyalty obligations to You and to properly administer Your participation in the Loyalty Program, we process relevant data.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing | To administer Your participation in the Loyalty Program and its events, including Your participation in special Loyalty Program games, events, etc., use of the Loyalty Program offers and benefits, to send the App notifications about that, their course or Your winnings. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data directly from You and/or based on Your use of our services in the App. |
| Legal basis for data processing | Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. |
| Data processed | Technical data: device ID, device model, operating system version, version of the App used. Account profile data: Your name, surname (if applicable within the e-mail address), e-mail address, phone number, password, user ID. Information on the use of the Program benefits / prizes collected: Point balances, history of their accumulation and redemption, data related to participation in games, contests, and tasks (e.g. participation status, points earned/achievements), offer activation data, notification delivery history and statuses, and prize granting/redemption data (excluding additional identification data, unless required by law). Other additional information that You choose to give us: For example, date of birth, gender, postal code, interests and/or consumption habits. |
| Data retention period | Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
In order to protect the integrity of the Loyalty Program, ensure fair participation and prevent abuse (e.g. scanning of receipts belonging to or left by another person, returning purchases while retaining the loyalty points awarded, violations of the prohibitions set out in clause 2.3 of the Rules), we carry out automated and, where there are grounds, manual monitoring of receipt scanning activity. Such monitoring is carried out by analysing scanning behaviour patterns to identify unusual or unfair use of the Program.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing | To carry out automated and manual monitoring of Your receipt scanning activity in order to protect the Loyalty Program from abuse, ensure fair participation and protect the legitimate interests of the Administrator and other Program participants. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data based on Your use of the App’s services, as well as, to the extent possible and applicable, from the points of sale and/or entertainment operating in the Shopping Centres. |
| Legal basis for data processing | To protect the Loyalty Program from fraud and abuse and to ensure fair operation of the Program for all participants (Article 6(1)(f) GDPR). |
| Data processed | Receipt scanning history: number of scanned receipts, date, time, frequency, point of sale. Scanning behaviour indicators: unusual scanning intensity, correlation between scanning and returns. Return data (if and to the extent we receive it from the respective point of sale and/or entertainment): fact of return, date, amount, link to a previously scanned receipt. Identification data linked to Your account, necessary to associate the behaviour pattern with a specific account: user ID, device ID. |
| Data retention period | Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai – to the extent necessary for monitoring compliance with the Rules. |
| Provision of Your personal data outside the EEA | Not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Emplate. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
When, participating in the Loyalty Program, You exchange the accumulated points into a loyalty prize(s) or take part in loyalty games, promotions and/or lotteries we organise and win a gift/prize, where the prize is monetary or the value of a non-monetary prize is EUR 100 and more, we process Your data related to this.
Your data processing shall be carried out as follows:
| Purpose of data processing | To ensure assessment of income (in kind or in cash) of the Program participant or game winner that collected a cash prize or a non-monetary prize worth more than EUR 100, also the assessment, declaration and payment of taxes due for this reason to the State Tax Inspectorate in Your name. |
|---|---|
| Data subjects | Loyalty Program participant that collects a gift/prize. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Article 6(1)(c) of the GDPR, implementing the legal obligations imposed on the controller by Article 5 of the Law on Personal income Tax. |
| Data processed | Winner’s personal data and contact details: Your full name, surname, personal identification number, Your e-mail address or phone number. PLEASE NOTE that we will process Your full name and surname and personal identification number for this purpose only to provide information to the State Tax Inspectorate in annual declaration No. GPM312 on payments to individuals treated as income of class A and B. Information about the collected prize: number, date and time, value. |
| Data retention period | 10 years after the signing of the prize transfer and acceptance deed. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Our authorised representatives in a relevant Shopping Centre, including the information centre staff of the Shopping Centre and agencies acting on our behalf, which provide services under written agreements, where such services are necessary for the proper implementation of the set aim, and collect data from You acting in our interests and by our instruction. State Tax Inspectorate |
| Provision of Your personal data outside the EEA | Not expected. |
| Presentation of personal identity documents | In order to verify the winner’s age, we or the Shopping Centre representative involved by us may ask You to present a personal identity document. Personal identity documents are only looked at, but are not copied, no photos of them are taken, no data from them is taken down or kept otherwise. |
| Failure to present the required data or to provide it fully and/or correctly | A participant may lose the right to the winning under the Rules of the Loyalty Program. |
If You agree to share Your location data with the App, Your visit to the Shopping Centre will be captured each time. Information about Your location is mainly used to give You loyalty points for Your visit, also it can be used to assess how many participants visited a Shopping Centre as a result of a particular Loyalty Program marketing campaign. Your location data is not shared with any stores operating within the Shopping Centre and is used solely by AKROPOLIS.
To determine Your location in the Shopping Centre: we use iBeacons. An iBeacon is a small Bluetooth transmitter that enables detection by smart devices when they are in close proximity. Determining Your location is activated in the App only through iBeacons installed in the common areas of the Shopping Centre.
Therefore, please note that we will not be determining Your location outside the Shopping Centre and You will not be able to share Your location with us by use of usual location determining services. To be able to determine Your location in the Shopping Centre, the App will ask You to enable the Bluetooth function in Your smart device, therefore, we do not and cannot determine your location outside the Shopping Centre.
In order for your location to be detected, the “Bluetooth” function must be enabled on your device and the App must be granted permission to use location detection via beacons. You may grant or withdraw this permission at any time in your device settings. If you disable location sharing, you will still be able to use the App; however, you will not receive points for visits.
Your location data processing shall be carried out as follows:
| Purpose of data processing | To capture Your visit to a Shopping Centre (Your location) and give loyalty points for this, also to assess how many participants visited a Shopping Centre as a result of a particular Loyalty Program marketing campaign. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data based on Your use of our services in the App. |
| Legal basis for data processing | Your consent as a data subject to the processing of Your location data (Article 6(1)(a) of the GDPR). |
| Data processed | Time of visit to the Shopping Centre and the fact of registration of such visit. Technical information required for iBeacon interaction (e.g. beacon identifier, signal strength). Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). |
| Data retention period | General period: Your data is stored for as long as Your consent remains valid, i.e. for 2 years from the date the consent was given, or until You withdraw it and/or delete Your profile in the Mobile App, or if You have been inactive in the App for 24 months (after which Your account data is retained for an additional 180 days in our backup systems). Once the consent period expires, Your data will no longer be processed for this purpose, and thereafter only anonymised (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
If, participating in the Loyalty Program, You acquire goods and/or or services in any of the points of sale and/or entertainment operating in the Shopping Centres and, wishing to get loyalty points or other benefits for it in accordance with the Rules, You use the App receipt scanning and/or uploading functionality, we process information in connection with Your purchase.
This data shall be processed to ascertain whether a purchase was made in any of the Shopping Centres participating in the Program and is in line with the terms and conditions of the Rules. In this regard, to ensure that the receipt of the purchase is valid and You get loyalty points for it, the date, amount of the receipt and relevant separate lines shall also be checked.
Please note that artificial intelligence (AI) technology is used in the receipt verification process, which extracts only the receipt content (e.g. date, amount, item details). At this stage, the receipt data is not linked to Your name or Loyalty profile; the AI processing is carried out in a technical manner that is separated from Your identity.
If a receipt is flagged for manual review in accordance with the Rules, it is verified without linking the receipt or its data to Your name or profile.
Only the final result (i.e. the purchase amount and the number of loyalty points awarded), following AI or manual verification, is assigned to Your Loyalty Program profile.
PLEASE NOTE that:
Receipt scanning is not a mandatory condition for participation in the Loyalty Program.
If, during Your participation in the Program, You present pharmacy receipts, they may contain information that theoretically may indirectly inform about Your health or health of persons related to You (e.g. names of acquired medicines or other medical items). Under the GDPR, such information could, in certain cases, be considered special categories of personal data if it were used to determine or assess a person’s health status. However, our processing of receipt data is not intended to draw any conclusions or make any assumptions about your health, nor is it used to apply any form of evaluation or decision-making in this regard. We do not carry out any profiling, nor do we analyze or systematically use receipt content for health-related purposes. Receipt information is used solely as purchase data, to the extent necessary to verify the validity of the receipt, determine whether the purchase complies with the Program Rules, and to calculate the loyalty points to which you are entitled or apply Program offers. As our processing is not aimed at determining or evaluating your health, such data is not considered special category data within the meaning of Article 9 of the GDPR.
In accordance with the provisions of the Rules, at our discretion, the receipt scanning function may not apply to some points of sale. Therefore, loyalty points or rewards for receipts from these specific points of sale cannot be collected.
In order to be able to scan a receipt in the App, the App will request Your consent to use the camera function of Your smart device. You can allow or disallow the App to use the camera function in the App settings in Your smart device at any time. You can do this in the settings section of the smart device by selecting relevant App control preferences and, accordingly, turning the device “Camera” on/off.
Your purchase data processing shall be carried out as follows:
| Purpose of data processing | To ascertain the conformity of the purchase to the requirements of the Rules with the help of the receipt scanning or uploading function, to determine the value of the purchase and to give loyalty points or other benefits for it, as well as to train and improve the receipt scanning functionality (to train it to automatically recognise the value of the purchase, etc.) and thus improve the customer experience. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You, at Your choice. |
| Legal basis for data processing | Ensuring receipt scanning function: Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. Training and improvement of the receipt scanning functionality: Legitimate interests of the data controller and/or third parties to properly provide and improve our services (Article 6(1)(f) of the GDPR). |
| Data processed | Purchase information You provide when You choose to scan a purchase receipt: name of the point of sale, Shopping Centre address, purchase date, purchase amount, line items (goods/services that You purchased). |
| Data retention period | Until deletion of Your account in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. Artificial intelligence (AI) solution services provider OpenAI, Inc., registration number 81086154, involved for the implementation of the receipt scanning function in the App. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to: using the services of Brevo or its affiliates; using artificial intelligence (AI) solutions of OpenAI, Inc. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
We want the Loyalty Program to be not only functional, but also useful to You. Therefore, in order to get to know You better, to create a meaningful experience and to offer what is relevant to You, we analyse how You use the Mobile App and its features – we record Your actions in the App (e.g. screen views, button clicks, offer activations, participation in games), using event tracking, as described in section 2.1 of this Privacy Policy.
The processing described in this section differs from the general App usage statistics analysis: here, the recognition of Your specific user behaviour patterns and the selection of individual content is carried out – this constitutes profiling, which requires Your separate consent. This profiling is not related to the sending of marketing notifications via external channels – a separate consent applies to that under section 8.
Such data processing shall be carried out as follows:
| Purpose of data processing | To analyse Your use of the Mobile App and Loyalty Program features and benefits in order to understand Your expectations and needs, and to display more relevant, personalised content and offers in the App.Unlike the general usage statistics analysis (described under section 2, Purpose No. 2), this processing is aimed at recognition of a specific user’s behaviour patterns and selection of individual content, and therefore constitutes a profiling activity that requires Your separate consent. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data based on Your use of our services. |
| Legal basis for data processing | Your consent as a data subject (Article 6(1)(a) of the GDPR). You may withdraw your consent at any time in the App settings; such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. |
| Processing logic | Your consent allows us to analyse how You use the Mobile App and the features of the Loyalty Program in order to understand Your habits, preferences, and interests. This analysis is carried out based on Your activity data recorded within the App, such as viewed screens, actions performed, activated offers, participation in program activities, and frequency of feature usage. Based on this data, we create thematic interest groups and determine what types of offers or communications may be most relevant to You.The profiling logic is focused on identifying Your usage patterns and selecting individual content in the App; however, it is not intended to draw any conclusions about sensitive aspects of Your profile. We do not use special categories of personal data, nor any information that would allow us to infer Your health status, political views, religious beliefs, or other protected characteristics. This profiling is not related to the sending of marketing notifications via external channels (e-mail, SMS, etc.) – a separate consent applies to that, as described in section 7 of this Privacy Policy. |
| Data processed | Technical data: device ID. Data collected during Your activity: Information about Your actions in the Mobile App (using it), also participation in the Loyalty Program, including use of its benefits, features and events (games, events, etc.), also any information that You choose to give us. Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). |
| Expected impact and potential consequences | The profiling carried out only results in you being shown more relevant offers, content, and recommendations within the App, thereby enhancing your user experience. It does not produce any legal or similarly significant effects, does not affect your ability to use the Loyalty Program or its services, and does not result in any differential treatment that would impact your rights or obligations. You may withdraw your consent to such data use at any time in the App settings, after which personalized offers will no longer be provided; however, you will still be able to use the App as usual. Any decisions that could have a more significant impact on you are not made solely by automated means – in all such cases, human intervention is ensured. Therefore, the restrictions on automated decision-making set out in Article 22 of the GDPR do not apply. |
| Data retention period | General period: Your data processed for the purpose of providing personalised offers is retained for as long as Your consent remains valid, i.e. for 2 years from the date the consent was given, or until You withdraw it and/or delete Your profile in the Mobile App, or if You have been inactive in the App for 24 months (after which Your account data is retained for an additional 180 days in our backup systems). Once Your consent expires, Your data will no longer be processed for this purpose, and thereafter only anonymised (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. Google LLC (US company), registration number 602223102 and/or Meta Platforms Inc. (US company), registration number 20-1665011, as providers of advertising network tools for measuring our Loyalty Program advertising and/or its impact. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Google LLC, Meta Platforms Inc. and/or any of their affiliates. The transfer of personal data to Brevo, Google LLC and Meta Platforms Inc. to the US is based on the EU-U.S. Data Privacy Framework approved by the European Commission. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
If You have consented in the App to receipt of our and Loyalty Program marketing notifications (including newsletters, short messages), we process Your e-mail address, phone number and/or Your smart device technical data.
Your consent will be valid for 2 years unless withdrawn earlier.
You can withdraw Your consent to receive (Your subscription of) news at any time by clicking a relevant link in the received newsletter or message (e.g. in an SMS/Whatsapp message) or in other ways indicated in section 9.3.7 of this Privacy Policy.
Your Personal Data processing shall be carried out as follows:
| Purpose of data processing | To send marketing notifications/information/ newsletters about us and the Loyalty Program, also to monitor and analyse actions with the newsletter and assess efficiency of sending notifications/newsletters, improve their content. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Your consent as a data subject to receive direct marketing notifications (Article 6(1)(a) of the GDPR). |
| Data processed | Contact details: E-mail address and/or phone number data. Technical data: Your smart device’s push token, intended for sending the App push notifications to Your smart device. Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). Data of tracking actions with a notification/newsletter: information whether a newsletter/notification has been read, when and how many times read (opened) or forwarded to others. |
| Data retention period | General period: Your data processed for the purpose of direct marketing is retained for as long as Your consent remains valid, i.e. for 2 years from the date the consent was given, or until You withdraw it and/or delete Your profile in the Mobile App, or if You have been inactive in the App for 24 months (after which Your account data is retained for an additional 180 days in our backup systems). Once Your consent expires, Your data will no longer be processed for this purpose, and thereafter only anonymised (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using a service package of Brevo and/or its affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
PLEASE NOTE that if You grant permission on Your smart device where You have the App installed, the App will be able to send You direct (push) notifications so that important information reaches You faster. Such notifications may include not only marketing notifications but also information about changes to this Privacy Policy or the Rules, changes of the opening hours of the Shopping Centres, upcoming games or offers, reminders to scan receipts. You can allow or disallow the App to send push notifications in the App settings in Your smart device at any time. You can do this in the settings section of the smart device by selecting relevant App control preferences and, accordingly, turning “Notifications” on/off.
If You have encountered a technical issue or any questions/comments regarding the Loyalty Program and/or the Mobile App, You can make a request at any time either directly in the App (using the relevant functionality of the App) or through our officially published contact e-mail addresses (by sending a message). Upon receipt of Your request, we administer it and the information in it, so that we can properly answer Your questions, solve the issue and/or ensure the smooth operation of the services. In this case, we process any related data and data that You provide.
PLEASE NOTE that requests made through the App are processed through Zendesk, Inc., a service provider established in the United States, therefore when using this channel Your data is transferred outside the European Economic Area. Such transfer is carried out on the basis of the EU-U.S. Data Privacy Framework approved by the European Commission on 10 July 2023, which ensures an adequate level of protection for Your data. For more information on data transfers outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy.
Such processing of Your data shall be carried out as follows:
| Purpose of data processing No 1 | To administer and respond to Your requests (including for support) and/or feedback regarding the services we provide, i.e. to ensure proper and objective examination of Your question and provision of the necessary/requested information or answer to Your question, request or claim. |
|---|---|
| Data subjects | Users of the Mobile App who installed it on their smart device. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Performance of a contract with You if Your request is related to our services and/or mutual contractual obligations (Article 6(1)(b) of the GDPR). Legal requirements applicable to us if we have a legal obligation to respond to Your request (Article 6(1)(c) of the GDPR). |
| Data processed | Technical data (processed only if the request is made through the App): device ID, device model, operating system version, version of the App used. Contact details: Your name, surname (if applicable within the e-mail address), e-mail address. Information You choose to provide: Your answers for a profile with us or any information related to Your request, e.g. Your surname, other phone number than indicated during the profile registration, etc. Data in the communication with the data controller (including staff): Request date, time, response date, time, content of correspondence, etc. Please take care of Your personal information protection and give us only the minimum of Your data needed for the objective assessment of Your question and giving You a response. |
| Data retention period | General period: Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. Zendesk, Inc., registration number 264411091, a provider of customer support and ticketing system solutions and tools. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Zendesk and/or any of their affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
| Purpose of data processing No 2 | To use your submitted requests in order to analyze the feedback received, assess the service usage experience, and improve the functionality, content, and overall quality of the App and the Loyalty Program. Such analysis is carried out to enhance our services in general and is not intended to evaluate your individual behavior. |
|---|---|
| Data subjects | App users and Loyalty Program participants who submit requests via the App or through other communication channels. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Legitimate interests of the data controller to improve our services based on Your feedback and/or suggestions (Article 6(1)(f) of the GDPR). The processing is proportionate, as the analysis is carried out solely for general service improvement purposes and is not intended to make decisions regarding your individual situation. |
| Data processed | Technical data (processed only if the request is made through the App): Device ID, device model, operating system version, version of the App used. Contact details: Your name, surname (if applicable within the e-mail address), e-mail address. Information You choose to provide: Your answers for a profile with us or any information related to Your request, e.g. Your surname, other phone number than indicated during the profile registration, etc. Data in the communication with the data controller (including staff): Request date, time, response date, time, content of correspondence, etc. Please take care of Your personal information protection and give us only the minimum of Your data needed for the objective assessment of Your question and giving You a response. |
| Data retention period | General period: Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients | Data processors involved by the data controller when and to the extent necessary for provision of a specific service: Emplate ApS, registration number 36031034, as the provider of the Loyalty Program platform and the Mobile App system tools. Sendinblue SAS (brand Brevo), registration number 498 019 298, as the provider of tools of the automation platform for sending the Loyalty Program communications, marketing notifications and tracking of system events, including its affiliates. Shopping centres AKROPOLIS Vilnius, AKROPOLIS Klaipėda and/or AKROPOLIS Šiauliai. Zendesk, Inc., registration number 264411091, a provider of customer support and ticketing system solutions and tools. |
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Zendesk and/or any of their affiliates. More on the provision of Your personal data outside the EEA, please read sections 9.1.5–9.1.6 of this Privacy Policy. |
We may also process all personal data referred to in this section above by each of the purposes of personal data processing in order to establish, exercise or defend legal claims. For this purpose, we will process personal data on the basis of our legitimate interest to establish, exercise or defend legal claims (Article 6(1)(f) of the GDPR). We will process it for this purpose until the end of the relevant legal procedures (e.g. settlement of a claim, entry into force of a judgment or arbitral award) and, if the relevant legal procedures are subject to a final decision of a court or another dispute settlement authority, for 5 years from the date of such decision.
Although we strive to protect Your personal data we process, please understand that we cannot ensure or guarantee the security of any information You give us, as no data transmission or storage method is 100% secure these days.
| Consent to | Possibility to withdraw consent | Way of withdrawal |
|---|---|---|
| Rules of the Program | Anytime | By deleting the Loyalty Program account |
| Receipt of personal offers of the Loyalty Program and provision of customised content based on App usage data analysis used to create a personal profile and display relevant Loyalty Program offers and personalised content in the App | Anytime | Directly in the App by selecting: “More”; “Profile settings”; “Consent to profiling”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by e-mail | Anytime | By clicking the “Unsubscribe” link in a received newsletter or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by SMS | Anytime | By clicking the “Unsubscribe” link in a received SMS message or directly in the App by selecting: “More”; “Profile settings”; “Direct marketing notifications by SMS”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by Whatsapp | Anytime | By clicking the “Unsubscribe” link in a received Whatsapp message or directly in the App by selecting: “More”; “Profile settings”; “Direct marketing notifications by Whatsapp”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications as push notifications of the App in Your smart device | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, turning “Notifications” on/off or by deleting the Loyalty Program account |
| Data sharing with third parties:- with Facebook and/or Google for the purposes of advertising the Loyalty Program (by transferring only the user ID assigned to You by the Program system) | Anytime | Directly in the App by selecting: “More”; “Profile settings”; “Sharing with third parties”; and ticking/unticking the relevant in the window that opens, or by deleting the Loyalty Program account |
| Sharing Your location data with the App | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, preferences of turning “Location data” sharing with the App on/off or by deleting the Loyalty Program account |
| Use of the “Camera” function in Your smart device for scanning receipts in the App | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, turning “Camera” function on/off or by deleting the Loyalty Program account |
If You wish to exercise Your rights or if You have any other questions in connection with the processing of Your data, You can contact us as follows: (i) by phone +370 65923632, (ii) by e-mail privatumas@akropolis.lt or (iii) at postal address Ozo g. 25, LT-07150 Vilnius. Address the letter as follows: To the Data Protection Officer of AKROPOLIS GROUP, UAB.
When contacting us, please indicate who makes the request and the point/facts of the issue. We will answer Your request as soon as possible, no later than within 1 month as of the receipt of Your request. However, with regard to complexity, nature of the request and the scope of the requested information or the number of Your requests, we may extend this period for 2 (two) more months, informing You about it before the end of the first month and indicating reasons for such extension.
PLEASE NOTE that in case You have been inactive in the App for 24 months, the account deletion consequences shall apply. We will notify You about this 1 month before taking any action to delete Your account.