Last reviewed and updated: 17th March 2026
This Privacy Policy applies when you (hereinafter, “You”, “Your”), when downloading and using the mobile app AKROPOLIS, also registering for and participating in AKROPOLIS Loyalty Program DŽIAUGSMAS, provide AKROPOLIS GROUP, UAB (hereinafter, the “Company”, “AKROPOLIS”, “our”, “we” and “us”) with Your personal data and give us a possibility to process it in the scope, ways and for the purposes provided for in this Privacy Policy and the Rules (hereinafter, the “Rules”) of the Loyalty Program DŽIAUGSMAS (hereinafter, the “Program” or the “Loyalty Program”).
The controller of Your Personal Data and its contact details:
AKROPOLIS GROUP, UAB
Legal entity code: 302533135
You can contact us on all matters in connection with the processing of Your Personal Data as follows:
Tel.: +370 65923632
E-mail: privatumas@akropolis.lt
Postal address: Ozo g. 25, LT-07150 Vilnius.
Address the letter as follows: To the Data Protection Officer of AKROPOLIS GROUP, UAB.
This Privacy Policy is aimed at providing information about when and how we, in the context of the Loyalty Program, process Your personal data: how we receive it, on what basis and for what purposes we use it, how we use it, how long we store Your personal data, whom we share it with, how we ensure Your personal data protection, also what rights You have in this context. We respect Your privacy and seek to protect Your personal data.
It is important that You carefully read this Privacy Policy before downloading the Mobile App AKROPOLIS and creating Your Loyalty Program account in the Mobile App, as each time You use our services or provide us with personal data otherwise, You must get familiar with the terms and conditions described in this Privacy Policy.
The Privacy Policy is not intended to obtain your consent to its provisions – it is provided to ensure that you are properly informed about the processing of your personal data. However, certain data processing is necessary for the operation and functionality of the Program. Therefore, if you choose not to use the App or if certain data processing practices are not acceptable to you, we will unfortunately not be able to offer you participation in the “DŽIAUGSMAS” Loyalty Program or provide its benefits. In such a case, you may at any time delete your account and remove the App from your device.
This Privacy Policy can be amended, updated by us, therefore, we recommend that You reread it from time to time in order to get familiar with the latest version of the document. The current version of the Privacy Policy of the Loyalty Program can always be found on AKROPOLIS website at akropolis.lt/vilnius/dziaugsmas, akropolis.lt/siauliai/dziaugsmas, akropolis.lt/klaipeda/dziaugsmas and in the Mobile App. If we make material changes to the Privacy Policy (for example, related to new data processing purposes, additional categories of data, or new data recipients), we will inform you separately, for instance via the App or by other appropriate means, so that you have the opportunity to review such changes before continuing to use the App.
PLEASE NOTE that in the context of the Loyalty Program, the services provided by AKROPOLIS can be used only by persons of 16 years of age and older. The Company does not collect personal data of persons under the age of 16, as this is not our target audience in relation to the processing of personal data. Therefore, if You are younger than 16, You cannot (i) download and install the Mobile App on Your smart device; (ii) register for and create a Loyalty Program account; (iii) provide us with any personal information necessary for or related to participation in the Program.
In the Privacy Policy below, You will find the following categorised information:
| AKROPOLIS, Company, we, our and us: | AKROPOLIS GROUP, UAB, which acts as the organiser and administrator of the Loyalty Program and, accordingly, as the controller of Your Personal Data collected for this purpose. The Company particulars and contact details are indicated in the preamble of the Privacy Policy. |
|---|---|
| Personal Data or personal data or data: | Any information, which is related to a natural person who is or can be directly or indirectly identifiable. Separate pieces of information that, if combined, can also help identify a particular person, also constitute personal data. |
| You and Your: | All natural persons at least 16 years of age who download and install the Mobile App AKROPOLIS on their smart device and/or register in it by creating their personal Loyalty Program profile and, accordingly, participate in the Loyalty Program DŽIAUGSMAS by becoming its members. |
| Loyalty Program or Program: | Our Loyalty Program titled DŽIAUGSMAS, operating in all the Shopping Centres. Information about the rules and conditions applicable to the Loyalty Program and Your participation in it is available in the separate Rules of the Loyalty Program that You can access on AKROPOLIS website at akropolis.lt/vilnius/dziaugsmas, akropolis.lt/siauliai/dziaugsmas, akropolis.lt/klaipeda/dziaugsmas and in the Mobile App. |
| Mobile App or App: | The mobile app AKROPOLIS (in Lithuania), by use of which You can control the Loyalty Program functionalities and/or use the benefits of the Program. |
| Services or services: | Services provided by AKROPOLIS in the Mobile App and services related to the Loyalty Program collectively or, when specified so, individually. |
| Shopping Centre or SC: | All of the following shopping and entertainment centres collectively or, where the context so requires and/or where it is indicated otherwise, any of them: AKROPOLIS Vilnius, AKROPOLIS Klaipėda and AKROPOLIS Šiauliai, including the entire territory of the relevant shopping centre and any premises of common use and public spaces (as well as the Business Centre premises if applicable). |
| GDPR: | Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation). |
| EEA: | European Economic Area. |
| EU: | European Union. |
Other concepts used in the Privacy Policy are in line with the concepts used in the Rules.
When You are using the App and take part in the Loyalty Program, we:
The Loyalty Program is accessible only in AKROPOLIS Mobile App – all features of the Program, all offers, accumulation of points, prizes and other loyalty benefits are accessible only after one downloads and installs the App in one’s smart device, also registers a personal account of the Program participant (see section on Registration and administration of a Loyalty account).
Meanwhile, certain functionalities of the Mobile App can also be used without registration as a participant of the Loyalty Program (without creating a personal participant’s account). Unregistered users can only see a limited portion of the App’s information and use only some of the App’s features, such as viewing news, opening hours, layout of a Shopping Centre, following their preferred shops, and so on.
When You install and use the App (whether or not You have a registered Loyalty Program account), to ensure the proper functioning of the App, improve existing and offer new functionalities, provide content relevant to You, e.g. according to shops You opted to follow, etc., we use the so-called event tracking, i.e. we record Your certain actions in the App, e.g. logins, App screen views, giving/withdrawal of consents, clicks (e.g. “follow”/“unfollow” a shop(s), “collect the prize”, etc.).
It is only after the registration of the Loyalty Program account that Your user actions in the App are linked to the information in Your account profile. Information collected prior to the account registration shall never be linked to Your account and participant’s information.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing No. 1 | To ensure the operation, security, and administration of the App, including its technical functionality, security, business continuity, error prevention, guest mode functionality, and core features available to both registered and unregistered users. |
|---|---|
| Data subjects | Users of the Mobile App who have installed it on their smart device (both registered and unregistered). |
| Data sources | We obtain Personal Data directly from You and/or based on Your use the App’s services. |
| Legal basis for data processing | Legitimate interest in ensuring the proper functioning and stability of the App (Article 6(1)(f) GDPR). |
| Data processed |
Technical data: Device ID, device model, operating system version, version of the App used. User identifier assigned by the system: for non-registered accounts – guest’s anonymised ID; for registered accounts – user ID. |
| Data retention period |
For non-registered accounts, as long as the App is installed and used in Your device. For registered accounts, until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Emplate. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
| Purpose of data processing No. 2 | Improvement of the App, analysis of its usage, and enhancement of user experience, including the collection of statistical data, event tracking, evaluation of functionality, UX improvements, and preparation of personalization capabilities (excluding advertising purposes). |
|---|---|
| Data subjects | All App users. |
| Data sources | Personal data is obtained based on your use of the App’s services (e.g. logins, screen views, button clicks, etc.). |
| Legal basis for data processing | Legitimate interest in analyzing and improving services (Article 6(1)(f) GDPR). |
| Data processed |
Technical data: Device ID, device model, operating system version, version of the App used. User identifier assigned by the system: for non-registered accounts – guest’s anonymised ID; for registered accounts – user ID. Other data collected for analysis purposes: Information about Your actions in (use of) the Mobile App, e.g. App login data, total number of logins and other data, settings, permissions, change of preferences, other actions You perform in the App. |
| Data retention period |
For non-registered accounts, as long as the App is installed and used in Your device. For registered accounts, until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
| Purpose of data processing No. 3 | Execution of personalized content and marketing activities, including the provision of personalized recommendations, personalization of notifications, advertising and marketing activities, and the use of advertising network tools (only where the user has opted in). |
|---|---|
| Data subjects | Registered users or users who have chosen to allow the sharing of data with advertising networks in the App settings. |
| Data sources | Your choices within the App. |
| Legal basis for data processing | Legitimate interests of the data controller to provide personalized content (Article 6(1)(f) GDPR). |
| Data processed |
Technical data: Device ID, device model, operating system version, version of the App used. User identifier assigned by the system: for non-registered accounts – guest’s anonymised ID; for registered accounts – user ID. Other data collected for analysis purposes: Information about Your actions in (use of) the Mobile App, e.g. App login data, total number of logins and other data, settings, permissions, change of preferences, other actions You perform in the App. |
| Data retention period |
For non-registered accounts, as long as the App is installed and used in Your device. For registered accounts, until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Google LLC, Meta Platforms Inc. and/or any of their affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
PLEASE NOTE that in the App settings You can choose whether to allow or disallow the transfer of Your data to third-party advertising networks (Google Inc. and/or Meta Platforms Inc.). You can do this directly in the App by selecting “More”, then “Profile settings” and “Sharing with third parties”, and marking/unmarking a relevant consent in the window that opens.
If this setting has not been selected or enabled by you, it will be considered that you do not consent to the sharing of data with advertising networks, and such data sharing will not be carried out.
Only registered participants of the Loyalty Program have a possibility to make use of all functionalities of the Program and, accordingly, of the Mobile App, i.e. only persons who registered in the App and created their personal account of a Program participant. It is only after the creation of an account and logging in to it that the customers will get a possibility to accumulate points and to exchange them for prizes and other benefits of the Program, to take personal offers and make use of any other opportunities that the Program provides.
If You decide to register an account, You can do so by:
PLEASE NOTE that the scope and nature of Your personal data that we collect and process will depend on the selected account registration method.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing | To register You as a participant of the Loyalty Program and administer the Loyalty Program account You created. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You or from Facebook social network or Apple account (if You take a relevant option to register). |
| Legal basis for data processing | Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. |
| Data processed |
Technical data: Device ID. Data required for Your login authentication: Phone number, password created. Account profile data:
Other additional information that You choose to give us: for example, date of birth, gender, postal code, interests and/or consumption habits. |
| Data retention period | Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
By participating in the Loyalty Program, You have the opportunity to actively engage in various loyalty actions – to accumulate points, use special offers and exclusive benefits, which are intended only for registered participants of the Program. As You accumulate points, use special offers and the opportunities provided by the Loyalty Program, including to play loyalty games, take part in events or promotions, in order to fulfil our loyalty obligations to You and to properly administer Your participation in the Loyalty Program, we process relevant data.
Such processing of Your Personal Data shall be carried out under the following terms, conditions and procedure:
| Purpose of data processing | To administer Your participation in the Loyalty Program and its events, including Your participation in special Loyalty Program games, events, etc., use of the Loyalty Program offers and benefits, to send the App notifications about that, their course or Your winnings. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data directly from You and/or based on Your use of our services in the App. |
| Legal basis for data processing | Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. |
| Data processed |
Technical data: Device ID, device model, operating system version, version of the App used. Account profile data: Your name, surname (if applicable within the e-mail address), e-mail address, phone number, password, user ID. Information on the use of the Program benefits / prizes collected: Point balances, history of their accumulation and redemption, data related to participation in games, contests, and tasks (e.g. participation status, points earned/achievements), offer activation data, notification delivery history and statuses, and prize granting/redemption data (excluding additional identification data, unless required by law). Other additional information that You choose to give us: for example, date of birth, gender, postal code, interests and/or consumption habits. |
| Data retention period | Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
When, participating in the Loyalty Program, You exchange the accumulated points into a loyalty prize(s) or take part in loyalty games, promotions and/or lotteries we organise and win a gift/prize, where the prize is monetary or the value of a non-monetary prize is EUR 100 and more, we process Your data related to this.
Your data processing shall be carried out as follows:
| Purpose of data processing | To ensure assessment of income (in kind or in cash) of the Program participant or game winner that collected a cash prize or a non-monetary prize worth more than EUR 100, also the assessment, declaration and payment of taxes due for this reason to the State Tax Inspectorate in Your name. |
|---|---|
| Data subjects | Loyalty Program participant that collects a gift/prize. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Article 6(1)(c) of the GDPR, implementing the legal obligations imposed on the controller by Article 5 of the Law on Personal Income Tax. |
| Data processed |
Winner’s personal data and contact details: Your full name, surname, personal identification number, Your e-mail address or phone number. PLEASE NOTE that we will process Your full name and surname and personal identification number for this purpose only to provide information to the State Tax Inspectorate in annual declaration No. GPM312 on payments to individuals treated as income of class A and B. Information about the collected prize: number, date and time, value. |
| Data retention period | 10 years after the signing of the prize transfer and acceptance deed. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
Other recipients:
|
| Provision of Your personal data outside the EEA | Not expected. |
| Presentation of personal identity documents | In order to verify the winner’s age, we or the Shopping Centre representative involved by us may ask You to present a personal identity document. Personal identity documents are only looked at, but are not copied, no photos of them are taken, no data from them is taken down or kept otherwise. |
| Failure to present the required data or to provide it fully and/or correctly | A participant may lose the right to the winning under the Rules of the Loyalty Program. |
If You agree to share Your location data with the App, Your visit to the Shopping Centre will be captured each time. Information about Your location is mainly used to give You loyalty points for Your visit, also it can be used to assess how many participants visited a Shopping Centre as a result of a particular Loyalty Program marketing campaign. Your location data is not shared with any stores operating within the Shopping Centre and is used solely by AKROPOLIS.
To determine Your location in the Shopping Centre: we use iBeacons. An iBeacon is a small Bluetooth transmitter that enables detection by smart devices when they are in close proximity. Determining Your location is activated in the App only through iBeacons installed in the common areas of the Shopping Centre.
Therefore, please note that we will not be determining Your location outside the Shopping Centre and You will not be able to share Your location with us by use of usual location determining services. To be able to determine Your location in the Shopping Centre, the App will ask You to enable the Bluetooth function in Your smart device, therefore, we do not and cannot determine your location outside the Shopping Centre.
In order for your location to be detected, the “Bluetooth” function must be enabled on your device and the App must be granted permission to use location detection via beacons. You may grant or withdraw this permission at any time in your device settings. If you disable location sharing, you will still be able to use the App; however, you will not receive points for visits.
Your location data processing shall be carried out as follows:
| Purpose of data processing | To capture Your visit to a Shopping Centre (Your location) and give loyalty points for this, also to assess how many participants visited a Shopping Centre as a result of a particular Loyalty Program marketing campaign. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data based on Your use of our services in the App. |
| Legal basis for data processing | Your consent as a data subject to the processing of Your location data (Article 6(1)(a) of the GDPR). |
| Data processed |
Time of visit to the Shopping Centre and the fact of registration of such visit. Technical information required for iBeacon interaction (e.g. beacon identifier, signal strength). Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). |
| Data retention period |
General period: Your data is stored for as long as your consent remains valid, i.e. for 2 years from the date the consent was given, or until you withdraw it and/or delete your profile in the Mobile App, or if you have been inactive in the App for 24 months (after which your account data is retained for an additional 180 days in our backup systems). Once the consent period expires, Your data will no longer be processed for this purpose, and thereafter only anonymized (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
If, participating in the Loyalty Program, You acquire goods and/or services in any of the points of sale and/or entertainment operating in the Shopping Centres and, wishing to get loyalty points or other benefits for it in accordance with the Rules, You use the App receipt scanning and/or uploading functionality, we process information in connection with Your purchase.
This data shall be processed to ascertain whether a purchase was made in any of the Shopping Centres participating in the Program and is in line with the terms and conditions of the Rules. In this regard, to ensure that the receipt of the purchase is valid and You get loyalty points for it, the date, amount of the receipt and relevant separate lines shall also be checked.
Please note that artificial intelligence (AI) technology is used in the receipt verification process, which extracts only the receipt content (e.g. date, amount, item details). At this stage, the receipt data is not linked to your name or Loyalty profile; the AI processing is carried out in a technical manner that is separated from your identity.
If a receipt is flagged for manual review in accordance with the Rules, it is verified without linking the receipt or its data to your name or profile. Only the final result (i.e. the purchase amount and the number of loyalty points awarded), following AI or manual verification, is assigned to your Loyalty Program profile.
PLEASE NOTE that:
Your purchase data processing shall be carried out as follows:
| Purpose of data processing | To ascertain the conformity of the purchase to the requirements of the Rules with the help of the receipt scanning or uploading function, to determine the value of the purchase and to give loyalty points or other benefits for it, as well as to train and improve the receipt scanning functionality (to train it to automatically recognise the value of the purchase, etc.) and thus improve the customer experience. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You, at Your choice. |
| Legal basis for data processing |
Ensuring receipt scanning function: Article 6(1)(b) of the GDPR, when processing is necessary for the performance of the agreement on Your participation in the Loyalty Program and on relevant services, to which You are a party as a data subject. Training and improvement of the receipt scanning functionality: Legitimate interests of the data controller and/or third parties to properly provide and improve our services (Article 6(1)(f) of the GDPR). |
| Data processed | Purchase information You provide when You decide to scan a purchase receipt: name of a point of sale, address of the Shopping Centre, date of purchase, amount of purchase, line elements (goods/services acquired). |
| Data retention period | Until deletion of Your account in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to: using the services of Brevo or its affiliates; using artificial intelligence (AI) solutions of OpenAI, Inc. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
We want the Loyalty Program to be not only functional, but also useful to You. Therefore, in order to get to know You better, to create a meaningful experience and to offer what is relevant to You, we analyse how You use the Mobile App and its features – this helps us understand Your needs, interests and expectations (e.g. screen views, button clicks, offer activations, participation in games). This information also allows us to provide You with customised offers, continuously improve Your experience, improve the Program and the App content, services and create new values in the Loyalty Program. This analysis is carried out using event tracking, as described in the earlier sections of this document. We, therefore, analyse and process data on the use of the features and benefits of the App and the Loyalty Program.
Such data processing shall be carried out as follows:
| Purpose of data processing | To provide customised offers of the Loyalty Program and better understand Your expectations and needs, as well as to improve existing and develop new services and benefits, including Mobile App features, to analyse Your use of the Mobile App and Loyalty Program features and benefits. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain Personal Data based on Your use of our services. |
| Legal basis for data processing | Your consent as a data subject (Article 6(1)(a) of the GDPR). You may withdraw your consent at any time in the App settings; such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. |
| Processing logic | Your consent allows us to analyze how you use the Mobile App and the features of the Loyalty Program in order to understand your habits, preferences, and interests. This analysis is carried out based on your activity data recorded within the App, such as viewed screens, actions performed, activated offers, participation in program activities, and frequency of feature usage. Based on this data, we create thematic interest groups and determine what types of offers or communications may be most relevant to you. This logic is focused on identifying your usage patterns and selecting personalized content; however, it is not intended to draw any conclusions about sensitive aspects of your profile. We do not use special categories of personal data, nor any information that would allow us to infer your health status, political views, religious beliefs, or other protected characteristics. |
| Data processed |
Technical data: Device ID. Data collected during Your activity: Information about Your actions in the Mobile App (using it), also participation in the Loyalty Program, including use of its benefits, features and events (games, events, etc.), also any information that You choose to give us. Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). |
| Expected impact and potential consequences | The profiling carried out only results in you being shown more relevant offers, content, and recommendations within the App, thereby enhancing your user experience. It does not produce any legal or similarly significant effects, does not affect your ability to use the Loyalty Program or its services, and does not result in any differential treatment that would impact your rights or obligations. You may withdraw your consent to such data use at any time in the App settings, after which personalized offers will no longer be provided; however, you will still be able to use the App as usual. Any decisions that could have a more significant impact on you are not made solely by automated means – in all such cases, human intervention is ensured. Therefore, the restrictions on automated decision-making set out in Article 22 of the GDPR do not apply. |
| Data retention period |
General period: Your data processed for the purpose of providing personalized offers is retained for as long as your consent remains valid, i.e. for 2 years from the date the consent was given, or until you withdraw it and/or delete your profile in the Mobile App, or if you have been inactive in the App for 24 months (after which your account data is retained for an additional 180 days in our backup systems). Once your consent expires, your data will no longer be processed for this purpose, and thereafter only anonymized (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo or its affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
If You have consented in the App to receipt of our and Loyalty Program marketing notifications (including newsletters, short messages), we process Your e-mail address, phone number and/or Your smart device technical data.
Your consent will be valid for 2 years unless withdrawn earlier.
You can withdraw Your consent to receive (Your subscription of) news at any time by clicking a relevant link in the received newsletter or message (e.g. in an SMS/Whatsapp message) or in other ways indicated in the section on Your rights as a data subject of this Privacy Policy.
Your Personal Data processing shall be carried out as follows:
| Purpose of data processing | To send marketing notifications/information/newsletters about us and the Loyalty Program, also to monitor and analyse actions with the newsletter and assess efficiency of sending notifications/newsletters, improve their content. |
|---|---|
| Data subjects | App users that created a personal Loyalty Program account. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Your consent as a data subject to receive direct marketing notifications (Article 6(1)(a) of the GDPR). |
| Data processed |
Contact details: e-mail address and/or phone number data. Technical data: Your smart device’s push token, intended for sending the App push notifications to Your smart device. Data related to Your consent and its validity: fact, date and time of obtaining and withdrawing consent (if any). Data of tracking actions with a notification/newsletter: information whether a newsletter/notification has been read, when and how many times read (opened) or forwarded to others. |
| Data retention period |
General period: Your data processed for the purpose of direct marketing is retained for as long as your consent remains valid, i.e. for 2 years from the date the consent was given, or until you withdraw it and/or delete your profile in the Mobile App, or if you have been inactive in the App for 24 months (after which your account data is retained for an additional 180 days in our backup systems). Once your consent expires, your data will no longer be processed for this purpose, and thereafter only anonymized (non-identifiable) data will be used. Data related to Your consent and its validity: 2 years after the expiration of the consent. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using a service package of Brevo and/or its affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
PLEASE NOTE that if You grant permission on Your smart device where You have the App installed, the App will be able to send You direct (push) notifications so that important information reaches You faster. Such notifications may include not only marketing notifications but also information about changes to this Privacy Policy or the Rules, changes of the opening hours of the Shopping Centres, upcoming games or offers, reminders to scan receipts. You can allow or disallow the App to send push notifications in the App settings in Your smart device at any time. You can do this in the settings section of the smart device by selecting relevant App control preferences and, accordingly, turning “Notifications” on/off.
If You have encountered a technical issue or any questions/comments regarding the Loyalty Program and/or the Mobile App, You can make a request at any time either directly in the App (using the relevant functionality of the App) or through our officially published contact e-mail addresses (by sending a message). Upon receipt of Your request, we administer it and the information in it, so that we can properly answer Your questions, solve the issue and/or ensure the smooth operation of the services. In this case, we process any related data and data that You provide.
PLEASE NOTE that requests made through the App are processed through Zendesk, a service provider operating in the United States. Therefore, submitting a request via the App is only possible if you have explicitly consented to the transfer of your data to third parties outside the EEA.
The default setting is that data transfer to third parties is disabled. This means that unless you explicitly provide your consent in the App settings, we consider that consent has not been given, and as a result, the request submission feature in the App is not available to you.
If you wish to allow the transfer of data to “Zendesk” and submit a request via the App, you can do so in the App settings by selecting “More”, then “Profile settings”, and “Sharing with third parties”, where you can enable or disable your consent. Once this setting is enabled, we receive confirmation of your consent and the option to submit requests in the App becomes available.
If you choose not to consent to data transfer (or disable the consent setting), the request submission feature in the App will not be available. In such a case, you may always contact us by email at lojalumas@akropolis.lt. Through this channel, your request will be handled directly by AKROPOLIS, without transferring your data to third parties.
Such processing of Your data shall be carried out as follows:
| Purpose of data processing No. 1 | To administer and respond to Your requests (including for support) and/or feedback regarding the services we provide, i.e. to ensure proper and objective examination of Your question and provision of the necessary/requested information or answer to Your question, request or claim. |
|---|---|
| Data subjects | Users of the Mobile App who installed it on their smart device. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Performance of a contract with You if Your request is related to our services and/or mutual contractual obligations (Article 6(1)(b) of the GDPR). Legal requirements applicable to us if we have a legal obligation to respond to Your request (Article 6(1)(c) of the GDPR). |
| Data processed |
Technical data (processed only if the request is made through the App): Device ID, device model, operating system version, version of the App used. Contact details: Your name, surname (if applicable within the e-mail address), e-mail address. Information You choose to provide: Your answers for a profile with us or any information related to Your request, e.g. Your surname, other phone number than indicated during the profile registration, etc. Data in the communication with the data controller (including staff): request date, time, response date, time, content of correspondence, etc. Please take care of Your personal information protection and give us only the minimum of Your data needed for the objective assessment of Your question and giving You a response. |
| Data retention period | General period: Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Zendesk and/or any of their affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
| Purpose of data processing No. 2 | To use your submitted requests in order to analyze the feedback received, assess the service usage experience, and improve the functionality, content, and overall quality of the App and the Loyalty Program. Such analysis is carried out to enhance our services in general and is not intended to evaluate your individual behavior. |
|---|---|
| Data subjects | App users and Loyalty Program participants who submit requests via the App or through other communication channels. |
| Data sources | We obtain personal data directly from You. |
| Legal basis for data processing | Legitimate interests of the data controller to improve our services based on Your feedback and/or suggestions (Article 6(1)(f) of the GDPR). The processing is proportionate, as the analysis is carried out solely for general service improvement purposes and is not intended to make decisions regarding your individual situation. |
| Data processed |
Technical data (processed only if the request is made through the App): Device ID, device model, operating system version, version of the App used. Contact details: Your name, surname (if applicable within the e-mail address), e-mail address. Information You choose to provide: Your answers for a profile with us or any information related to Your request, e.g. Your surname, other phone number than indicated during the profile registration, etc. Data in the communication with the data controller (including staff): request date, time, response date, time, content of correspondence, etc. Please take care of Your personal information protection and give us only the minimum of Your data needed for the objective assessment of Your question and giving You a response. |
| Data retention period | General period: Until deletion of Your profile in the Mobile App or after 24 months of inactivity in the Mobile App (then Your account data is retained for 180 more days in our automatically generated backup copy). Later, we will use Your profile data only in anonymised form. |
| Data recipients |
Data processors involved by the data controller when and to the extent necessary for provision of a specific service:
|
| Provision of Your personal data outside the EEA | It is not expected and will not normally occur except where it may be necessary to transfer personal data when that is related to using the services of Brevo, Zendesk and/or any of their affiliates. More on the provision of Your personal data outside the EEA, please read the section on data transfers outside the EU/EEA of this Privacy Policy. |
We may also process all personal data referred to in this section above by each of the purposes of personal data processing in order to establish, exercise or defend legal claims. For this purpose, we will process personal data on the basis of our legitimate interest to establish, exercise or defend legal claims (Article 6(1)(f) of the GDPR). We will process it for this purpose until the end of the relevant legal procedures (e.g. settlement of a claim, entry into force of a judgment or arbitral award) and, if the relevant legal procedures are subject to a final decision of a court or another dispute settlement authority, for 5 years from the date of such decision.
In order to protect Your privacy and data, we use various technical and organisational measures to protect Your personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or use, as well as against any other forms of unlawful processing, including but not limited to:
Although we strive to protect Your personal data we process, please understand that we cannot ensure or guarantee the security of any information You give us, as no data transmission or storage method is 100% secure these days.
As a data subject, You have the right to contact us regarding any questions related to the processing of Your personal data. You have the following rights in relation to Your personal data we process:
| Consent to | Possibility to withdraw consent | Way of withdrawal |
|---|---|---|
| Rules of the Program | Anytime | By deleting the Loyalty Program account |
| Receipt of personal offers of the Loyalty Program and provision of customised content based on Your use of the App and our profiling for this purpose | Anytime | Directly in the App by selecting: “More”; “Profile settings”; “Consent to profiling”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by e-mail | Anytime | By clicking the “Unsubscribe” link in a received newsletter or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by SMS | Anytime | By clicking the “Unsubscribe” link in a received SMS message or directly in the App by selecting: “More”; “Profile settings”; “Direct marketing notifications by SMS”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications by Whatsapp | Anytime | By clicking the “Unsubscribe” link in a received Whatsapp message or directly in the App by selecting: “More”; “Profile settings”; “Direct marketing notifications by Whatsapp”; “NO/YES”, or by deleting the Loyalty Program account |
| Receipt of direct marketing notifications as push notifications of the App in Your smart device | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, turning “Notifications” on/off or by deleting the Loyalty Program account |
| Data sharing with third parties: with Facebook and/or Google for the purposes of advertising the Loyalty Program (by transferring only the user ID assigned to You by the Program system); and with Zendesk for the purpose of servicing requests (tickets) submitted by You in the App (by transferring the data of communication with You and technical data of Your device) | Anytime | Directly in the App by selecting: “More”; “Profile settings”; “Sharing with third parties”; and ticking/unticking the relevant in the window that opens, or by deleting the Loyalty Program account |
| Sharing Your location data with the App | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, preferences of turning “Location data” sharing with the App on/off or by deleting the Loyalty Program account |
| Use of the “Camera” function in Your smart device for scanning receipts in the App | Anytime | Directly in the smart device settings intended for the App, by selecting relevant App control preferences and, accordingly, turning “Camera” function on/off or by deleting the Loyalty Program account |
If You wish to exercise Your rights or if You have any other questions in connection with the processing of Your data, You can contact us as follows: (i) by phone +370 65923632, (ii) by e-mail privatumas@akropolis.lt or (iii) at postal address Ozo g. 25, LT-07150 Vilnius. Address the letter as follows: To the Data Protection Officer of AKROPOLIS GROUP, UAB.
When contacting us, please indicate who makes the request and the point/facts of the issue. We will answer Your request as soon as possible, no later than within 1 month as of the receipt of Your request. However, with regard to complexity, nature of the request and the scope of the requested information or the number of Your requests, we may extend this period for 2 (two) more months, informing You about it before the end of the first month and indicating reasons for such extension.