Privacy Policy (GDPR)

Controller

Lithuanian National Accreditation Bureau, contact details as published on the contact page. Data protection enquiries: through the contact form, marked “GDPR”.

Data we process

• Registry data — publicly available information about accredited bodies (names, accreditation numbers, locations, contacts, scopes) published under Clause 8.2.2.
• Inquiries & leads — name, contact details, organisation and message content you submit, with your consent recorded (timestamp, IP address, user agent).
• Anonymous complaints — identity is optional; IP/user agent are retained only for abuse prevention and are not linked to case reporting.
• Applications & assessment records — processed for the accreditation procedure under the legal obligations of Regulation (EC) No 765/2008 and the accreditation rules.
• E-shop orders — billing and delivery data processed for contract performance.

Legal bases & retention

• Legal obligation / public task (accreditation), consent (inquiries, newsletters), contract (orders). Records are retained per the statutory retention schedule (accreditation files: 10 years; inquiries: 24 months; accounting records: statutory period).

Your rights

• Access, rectification, erasure, restriction, portability and objection; withdrawal of consent at any time; right to lodge a complaint with the State Data Protection Inspectorate.

Processors & transfers

• Personal data is processed within the EU/EEA using service providers bound by data processing agreements; no data is sold or used for automated decision-making.