Privacy policy

We are aware of the particular importance we attach to the protection of your personal data, and we only collect and process your data that is necessary for the performance of our activities. We process personal data lawfully, transparently and fairly, for predefined purposes and only to the extent necessary to achieve those purposes. When we process personal data, we aim to keep it accurate, secure, confidential, properly stored and protected.

When processing your personal data, we comply with the requirements of the General Data Protection Regulation (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, as well as with the requirements for the processing of personal data set out in other legal acts.

1. What is this document?

1.1 By reading this privacy policy (hereinafter – the Privacy Policy), you will learn how and for what purposes we process your personal data, where we obtain them, to whom we provide them and how we store them, and what your rights are as a personal data subject.

1.2 The Privacy Policy also sets out the terms and conditions of use of the website www.cup.lt (hereinafter – the Website). If you do not agree to the Privacy Policy, you are not entitled to use the Website.

1.3 For the purposes of this Privacy Policy, the term "personal data" means any information from which you can be identified, whether directly or indirectly. Personal data includes name, surname, e-mail address, telephone number, location data and internet identifier, characteristics specific to you and other personal data as defined in the GDPR.

2. Who are we?

2.1 We are UAB PROSPERITAS BALTICA, legal entity code 121675895, registered office address Upės g. 9, Vilnius, Republic of Lithuania, informative e-mail: info@cup.lt, person responsible for personal data protection: lawyer Olga Bogdanovič, phone +370 616 21450.

2.2 In accordance with the provisions of the legal acts, we are the controller of your personal data.

3. What principles do we follow?

3.1. In processing your personal data:

a) we will comply with the requirements of current and applicable legal acts, including the GDPR;

(b) we will process your personal data in a lawful, fair and transparent manner;

(c) we will collect your personal data for specified, explicit and legitimate purposes and will not further process them in a way that is incompatible with those purposes, except to the extent permitted by the legal acts;

(d) we will take all reasonable steps to ensure that personal data which are not accurate or complete in relation to the purposes for which they are processed are rectified, supplemented, suppressed or erased without delay;

(e) we will keep them in a form which permits your identification for no longer than is necessary for the purposes for which the personal data are processed;

(f) we will not disclose personal data to third parties or make them publicly available, except as set out in the Privacy Policy or applicable legal acts;

(g) we will ensure that your personal data is processed in such a way that appropriate technical or organisational measures are taken to ensure adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. 

4. How do we collect your personal data?

4.1 We process your personal data received in the following ways:

a) When you provide them to us. You provide us with your personal data and other information by using the Website, writing to us or communicating with our customer service team, submitting your complaints and/or queries, subscribing to our newsletter, submitting your curriculum vitae (CV), or otherwise. Please note that if you contact us in writing or by e-mail, we will keep the details of the correspondence.

b) When you use our Website. When you use the Website that we operate, certain information (e.g. Internet Protocol (IP) address, the type of web browser you use, the number of times you visit the Website, the number of pages you view, the amount of time you spend on the Website, the online source from which you came, the information about the device you are using, the language you use, the country you are in, the internet service provider you are using, and so on) is collected automatically.

c) When we receive your personal data from other persons.

4.2 We may combine the personal data we receive from you with data collected by us from other public or accessible sources. For example, we may combine the personal data you provide with data obtained through the use of cookies on the Website, data collected in the course of providing services to you, or with data lawfully obtained from third parties. You will always be able to request the rectification of erroneous personal data and exercise your other rights as a data subject. 

5. For what purposes and how do we process your personal data?

5.1 We will process your personal data for the following purposes:

a) To improve the Website and to offer you better and more tailored services and/or products. We use your personal data, including the personal data we receive from your use of our Website, to improve and develop the Website and to offer you better and more tailored services and/or goods.

We may collect the following information through cookies: internet address (IP), type of internet browser used, number of visits, pages viewed on the Website, time spent on the Website, the internet source from which you came, information about the device used, language, country, internet service provider, etc.

For this purpose, we use the personal data we receive from you, generated by your use of the Website and/or received from others.

Please see section 7 of this Privacy Policy for more information on how we use cookies and similar technologies.

(b) For direct marketing purposes. We process your personal data with your consent in order to provide you with newsletters, including offers and information about our, our affiliates' and partners' goods and/or services, events or other information, to improve our services.

For this purpose, we process the following personal data: name, surname, e-mail address, nickname of the social account profile, telephone number.

For this purpose, we obtain your personal data from you.

For this purpose, we provide or transfer your data to: companies providing newsletter services, companies providing business information management systems, companies providing services for the administration of the Website itself.

For this purpose, we keep your personal data for a maximum of 2 years from the date of your consent.

For more information on the processing of personal data for direct marketing purposes, please refer to Section 6 of this Privacy Policy.

c) For the purpose of security of property and persons (video surveillance of our shopping centre premises and/or territory). In order to ensure the protection of property rights, to guarantee the security and integrity of property, as well as the safety of our employees, customers and other persons (visitors to the shopping centre), we process your personal data.

For this purpose, we process video recordings, which may capture personal data such as image, personally identifiable information (information about body shape, clothes worn, etc.), registration numbers of entering and exiting vehicles, and other data as specified in our Video Surveillance and Video Data Processing Rules.

For this purpose, we obtain your personal data from our video surveillance equipment.

For this purpose, we provide or transfer your data to: companies providing security services, companies managing car parks.

We carry out video surveillance and process video recordings in accordance with the legal acts and our own rules on video surveillance and video data processing.

d) For the purpose of quality control of our activities (storing complaints and/or requests and communications made by you). When you contact us (or we contact you following your enquiry), we will store information from e-mail or written correspondence. We collect such information to ensure the quality of our service and to monitor our services delivery.

For this purpose, we process the following personal data: name, surname, e-mail address, place of residence (address), content of the complaint and/or enquiry, telephone number, date and time of contact, communication information.

For this purpose, we obtain your personal data: from you yourself, where we may create personal data ourselves in the course of a query or analysis of a complaint (e.g., upon receipt of your complaint, we contact our staff to establish the actual circumstances of the complaint and record them, etc.); from third parties: companies providing security services.

For this purpose, we provide or transfer your data to: companies providing security services, companies providing business information management system administration services, companies providing auditing, legal or other consulting services.

For this purpose, we retain your data for 90 calendar days from the date of recording, unless there are grounds to believe that a crime or other unlawful act has been recorded or an internal investigation has been initiated, until the end of the relevant investigation and/or proceeding.

e) For the purpose of concluding and/or properly enforcing commercial contracts. We normally enter into commercial contracts for the lease, use, advertising, services, contracting, event organisation or other contracts with business partners who are legal persons. In such cases, we process your data as a natural person if you are the representative and/or contact person of such a legal entity.

For this purpose, we process the following personal data: name, surname, (mobile) phone number, e-mail address, address, personal identification number, bank account details, ID number.

For this purpose, we receive your personal data from: you, legal entities of which you are an agent or contact person.

For this purpose, we provide or transfer your data to: companies providing business management information system administration services, companies providing auditing, legal or other consulting services.

For this purpose, we keep your personal data for the duration of the contract and for 5 years after it ends. This period may be extended in the event of a (legal) dispute, in which case the personal data will be stored until the date of the mutual agreement and/or the final judgment. In the absence of an agreement, your personal data will be stored for a maximum of 120 calendar days from the moment of such a decision.

f) For the purpose of selecting candidates for the positions we offer in our company. We process your personal data in order to find and select candidates who meet our needs and to assess their suitability for the job offered.

For this purpose, we process your personal data obtained from you (e.g. data provided by you in your CV, data collected during communication, etc.) and/or obtained from other persons (e.g. recommendations from current or former employers or acquaintances, social networks, mass media, etc.).

We do not provide or transfer your data for this purpose.

For this purpose, we will keep your data for 90 calendar days from the date on which the competition for the job we are offering was closed, unless we have your separate consent to keep the data for longer.

g) Organising competitions and games for our customers. 

For each competition or game, we specify in the individual rules what data is required to participate. It is your choice whether or not to participate in the competitions or games we run and therefore whether or not to provide the relevant data.

We generally collect the following data: name, surname, e-mail address, contact details (phone number, city of residence), date of birth, content created by the participant or any other personal data you provide, according to the needs of the competition or game.

If a cash prize has been set up, we may additionally ask for your personal identification number and bank account number. A personal identification number may also be required in these cases for the purposes of paying applicable taxes, if the competition organiser is obliged to pay the relevant taxes.

The Company reserves the right not to return any content submitted to the competition if it should have been submitted in any tangible form in accordance with the rules of the competition or game.

We need this data in order to be able to run a competition or game.

We collect your contact details in order to enforce the rules of the game or competition and to inform the winner about the possibility of claiming the prize. In order to maximise transparency, we usually announce the winner publicly on our website, Facebook account and/or Instagram platform (depending on the nature of the competition). Your consent to this public announcement is given when you agree to participate in the competition or game (this is usually also stated in the game rules).

h) Photographs and videos taken at public events or photo shoots. We process your personal data for the purpose of disseminating information about CUP Shopping Centre. Various events in the CUP premises may be photographed and/or filmed, which may result in visitors being in the frame. The captured images may be used on websites, social media accounts or otherwise made public for advertising, marketing, publicity and related purposes in the manner and form chosen by the Company.

We sometimes organise special photo shoots to raise awareness and promote CUP. If you are a participant in such photo shoots, we will publish and use your image in photographs or videos on the basis of your consent, subject to the conditions and for the purposes set out therein. By participating in a filmed or photographed event, you consent to your image being captured and used by the Company in the ways and according to the procedures set out in this notice. You may withdraw your consent by informing at info@cup.lt.

With the consent of the winner of a game or competition we run, we will publish (in the press and other media) photographs or videos of the winner.

The Company will process the image data for two years from the date of capture or until your consent is withdrawn. Such personal data may, in certain cases, be retained for a longer period of time if necessary for the protection of the Company's rights and legitimate interests and in other cases provided for by the legal acts.

The Company may use other persons to capture or process image data to whom the data may be transmitted.

(i) For other purposes provided for in our Personal Data Processing Rules and/or other internal documents, where we are required to process your personal data by the legal acts or where there is a legitimate interest.

6. Do we use your personal data for direct marketing and what are our newsletter subscription rules?

6.1 Subject to your additional consent, we may use your personal data for the purpose of direct marketing in order to provide you with offers and information about goods and/or services from us, our affiliates and partners that we think may be of interest to you.

6.2 For this purpose, we process the following personal data: name, surname, e-mail address, nickname of your social account profile, telephone number.

6.3 You can choose whether you allow us to use your personal data for direct marketing purposes. You can do this on the Website and on our social media accounts "NEWSLETTER" by entering your e-mail address and clicking on the subscription confirmation.

6.4 By granting us the right to process your data for the purpose of direct marketing, you also grant us permission to contact you for this purpose by means of communication (e.g. e-mail, telephone, SMS or other means of communication (e.g. Facebook, Instagram, etc.).

6.5 We may combine the information we hold about you with information held by third parties.

6.6 If you consent to the use of your personal data for direct marketing purposes, we may use your personal data to analyse and improve the effectiveness of our websites, advertising and market research, and for other company marketing and sales purposes. In this case, we will use your personalised data.

6.7 Even if you have given your consent to the processing of your personal data for direct marketing purposes, you can easily withdraw this consent at any time for all or part of the processing of personal data. To do so, you can:

a) notify about your unsubscription in the manner indicated in the e-mail notifications and/or offers (e.g. by clicking on the link "If you no longer wish to receive CUP news, please click here" or similar);

b) by coming to our shopping centre at Upės g. 9, Vilnius, and submitting the relevant request at the Information Centre on the 1st floor of the building. You must clearly state your name on the application. If you wish to withdraw your consent in this way, we may ask you to provide proof of identity;

c) send us a request by e-mail to reklama@cup.lt. The request must clearly state your name and surname and other registration details (if any). If you wish to withdraw your consent in this way, we may ask you to provide proof of identity.

6.8 If you withdraw your consent, we will endeavour to stop processing your personal data for the purpose of direct marketing as soon as possible.

6.9 Withdrawal of consent does not automatically oblige us to destroy your personal data or to provide you with information about our processing of your personal data, so if you wish us to do the same, you must make a separate request.

7. How do we use cookies?

7.1 We collect information about you by using cookies and similar technologies. Cookies are small files that are temporarily stored on your device's hard drive and allow us to recognise you on subsequent visits to the Website, save your browsing history, preferences, customise content, speed up searches on the Website, create a user-friendly and convenient Website environment, and make the Website more efficient and reliable. Cookies are a common practice on websites that make it easier to use the website.

7.2 We may collect the following information by means of cookies: the Internet Protocol (IP) address of the type of web browser you are using, the number of times you have visited the Website, the pages you have viewed, the time you have spent on the Website, the Internet source from which you came, information about the device you are using, the language you are using, the country you are in, and the internet service provider.

7.3 We use the information we receive via cookies for the following purposes:

(a) to ensure the functionality of the Website (e.g. to enable you to use the Website's personalisation);

b) so that we can improve and develop the Website to better meet your needs;

(c) for the development of services and analysis of the use of the Website;

(d) targeted marketing guidance.

7.4 We may, without prejudice to the legal acts, combine information obtained through the use of cookies with information obtained about an individual by other means (e.g. information about the use of the Website, personal data provided by you).

7.5 The Website may use the following cookies:

a) technical cookies – these are cookies that are necessary for the operation of the Website;

b) functional cookies – these are cookies that, although not essential to the operation of the Website, significantly improve its performance, quality and user experience;

c) analytical cookies – these are cookies that are used to compile a statistical analysis of the navigation methods of visitors to the Website; the data collected by these cookies is used anonymously;

(d) targeting or promotional cookies – these are cookies that are used to show you offers or other information that may be of interest to you;

e) social network cookies – these are cookies that are necessary for you to use the Website information in your social profile account.

7.6 Full details of the cookies used on the Website, their purpose, validity and the data used are set out in the table below:

7.7 You can consent to the use of cookies in the following ways:

(a) by not deleting them and/or changing the settings on your web browser so that it does not accept cookies;

b) by clicking on the "I accept" checkbox in the cookie link (bar) on the Website.

7.8 You can withdraw your permission to use cookies at any time. You can do this by changing the settings on your web browser so that it does not accept cookies. How you do this depends on the operating system and web browser you are using. For detailed information on cookies, their use and your options for refusing them, please visit http://AllAboutCookies.org or http://google.com/privacy_ads.html.

7.9 In some cases, in particular the disabling of technical and functional cookies, the refusal to accept cookies or their deletion may slow down the speed of browsing the Internet, restrict the functioning of certain functions of the Website, block access to the Website.

8. Who do we provide your personal data to?

8.1 We guarantee that your personal data will not be sold, provided or otherwise transferred to third parties without lawful basis, or used for purposes other than those for which they were collected. We will not transfer your personal data in any way other than in accordance with this Privacy Policy and/or our Personal Data Processing Rules and legislation. However, we reserve the right to provide information about you if we are required to do so by law or if we are requested to do so by lawful authorities or prosecuting authorities.

8.2 We may transfer your personal data to companies that assist us in the performance of our activities, including direct marketing. We require such partners to process your data only in accordance with the instructions we have given them and applicable data protection legislation. We enter into contracts with these parties which oblige them to strictly comply with the requirements for the protection of personal data.

8.3 The above service providers are limited in their ability to use your data and may not use them for purposes other than to provide services to us.

8.4 A non-exhaustive list of the persons and categories of persons to whom we transfer your personal data is set out in Section 5.1 of this Privacy Policy separately for each purpose of use of personal data.

9. How long do we keep your personal data?

9.1 We shall not keep your personal data for longer than the purposes of processing or the law requires, unless a longer retention period is specified in the law.

9.2 We aim not to store outdated, irrelevant personal data, so that only relevant information is retained when it is updated (e.g. when information is revised, changed, etc.). Historical information is retained where it is necessary for the purposes of the law or for the conduct of our business.

9.3 Section 5.1 of the Privacy Policy specifies the retention periods of your personal data separately for each purpose of personal data use.

10. How do we protect your personal data?

10.1 The data we collect from you will be located within the EU, but may be transferred or stored outside the EU. It may also be processed by our or our suppliers' staff working outside the EU. When we transfer your data outside the EU, we will take all reasonable steps to ensure that your data are processed securely and in accordance with this Privacy Policy.

10.2 Unfortunately, the transmission of information over the internet is not completely secure. Although we take great care to protect your personal data, we cannot guarantee the security of the data when you transmit data to the Website – you assume the risks associated with the transmission of data to the Website. Once we receive your data, we will implement strict procedures and security measures to protect your data from unauthorised access.

10.3 In the unlikely event that we become aware of a breach of security of your personal data which may pose a serious threat to your rights or freedoms, we will inform you immediately upon becoming aware of it and identifying the information accessed.

11. External websites

11.1 The Website may contain links to external websites, such as our business partners' websites or websites advertising our goods and/or services. If you follow such links to any of these websites, please note that these websites and the services available through them have their own separate privacy policies and we do not accept any responsibility or liability for these policies or for the personal data, such as contact or location data, collected on these websites or through these services. Please review these policies before submitting personal data to these websites or using any services.

12. What rights do you have?

12.1 When processing personal data, we ensure your rights in accordance with the GDPR and the Law on Legal Protection of Personal Data of the Republic of Lithuania. As a personal data subject you have the following rights:

(a) to know (be informed) about the processing of your personal data;

(b) to have access to your personal data that we process;

(c) to request the rectification or completion, clarification of inaccurate, incomplete or incorrect personal data;

(d) to require the destruction of personal data when they are no longer necessary for the purposes for which they were collected;

(e) to require the destruction of personal data where the processing is unlawful or where you withdraw or withhold your consent to the processing of personal data, which is necessary;

(f) to object to the processing of personal data or to withdraw consent previously given;

(g) to request the suspension (other than storage) of the processing of your personal data in the event of disputes or to verify the lawfulness of the processing, the accuracy of the data, or where we no longer need your personal data, but you do not want us to delete them;

(h) to require the provision, where technically feasible, of your personal data collected pursuant to your consent or for the purposes of the performance of a contract, in an easily readable format, or request that it be transmitted to another controller.

12.2 We will endeavour to guarantee the exercise of your rights as a data subject and to provide all the conditions for the effective exercise of those rights, but we reserve the right not to comply with your requests where it is necessary to ensure:

(a) fulfilling the legal obligations imposed on us;

(b) national security or defence;

(c) public policy, the prevention, investigation, detection or prosecution of criminal offences;

(d) important economic or financial interests of the State;

(e) the prevention, investigation and detection of breaches of official or professional ethics;

(f) the protection of your rights and freedoms or the rights and freedoms of other persons.

12.3 You may submit claims relating to the exercise of your rights to us in person, by post or by electronic communication. Upon receipt of your request, we may ask you to provide proof of identity, as well as other additional information we require in connection with your request.

12.4 Upon receipt of your request, we will respond to you no later than 30 calendar days from the date of receipt of your request and the submission of all documents necessary to provide the response.

12.5 If we deem it necessary, we will suspend the processing of your data, except for storage, until your request is resolved. If you lawfully withdraw your consent, we will cease processing your personal data immediately, but no later than 30 calendar days, except in the cases set out in clause 12.2 of this Privacy Policy and in the cases provided for by law, i.e. where we are obliged to continue to process your personal data by applicable law, by a legal obligation incumbent on us, by a judicial decision or by a binding order from the authorities.

12.6 If we refuse to comply with your request, we will clearly state the reason for such refusal.

12.7 If you disagree with our actions or our response to your request, you may complain about our actions and decisions to a competent public authority.

13. Who can you complain to?

13.1 If you wish to make a complaint about our processing, please submit it in writing, providing as much information as possible, using the contact details provided at the end of this policy. We will cooperate with you and endeavour to resolve any issues promptly.

13.2 If you believe that your rights under the GDPR have been infringed, you may lodge a complaint with our supervisory authority, the State Data Protection Inspectorate, for more information and contact details, please visit the Inspectorate's website (www.ada.lt). Although, first and foremost, we aim to resolve any disputes promptly and amicably with you.

14. How will this Privacy Policy be amended?

14.1 Any changes to our Privacy Policy will be posted on the Website. We will notify you of such changes as necessary. New terms of our Privacy Policy may also be posted on the Website and you may need to read and agree to them in order to continue using the Website and/or our services.

15. How to contact us?

15.1 Please send all documents relating to this Privacy Policy to or contact us at the following contact details:

a) by post – UAB "PROSPERITAS BALTICA", registered office address Upės g. 9, Vilnius, Republic of Lithuania;

b) by e-mail – info@cup.lt.

We keep our privacy policy under constant review. This privacy policy was updated on 17 January 2022.