Privacy policy

PRIVACY STATEMENT CONCERNING THE PROCESSING OF PERSONAL DATA

This Privacy Statement is intended for persons, business entities or their representatives with whom UAB “Baltijos filmų paslaugos” (the Company) concludes contracts in an audiovisual work (film) production project (the Project).

Data controller

UAB “Baltijos filmų paslaugos”
Entity number: 306394213
Address: Gedimino pr. 21-101, Vilnius
Phone +370 5 276 2335
E-mail info@balticfilmservices.com

Data protection officer
Rusnė Juozapaitienė
Phone +370 698 34316
E-mail rusne@duomenuapsauga.eu

The Company processes personal data in accordance with the GDPR [1], the Law of the Republic of Lithuania on Legal Protection of Personal Data and other applicable legal acts. 

The information about the purposes of the personal data processing, the categories of data subjects and personal data, the legal bases for the processing of personal data, also the time limits for storing personal data and the recipients of personal data is provided below. This Privacy Statement is published on the website of UAB “Baltic film services”, the data processor of the Company at https://balticfilmservices.com/.

Sources of personal data 

The Company receives your data directly from you, your employers, contracting parties, consultants, or third parties such as agencies or former employers. If you do not provide the necessary personal data or object to their processing, the Company will not be able to conclude and / or perform the contract and ensure your legal guarantees.

Processing of personal data of actors and / or their representatives 

What we process: personal data of actors and / or their representatives for the purpose of Project implementation, contract performance, call sheet preparation, pay administration and Project publicity. The following personal data is processed (including, but not limited to): the name, surname, phone number, e-mail, social security number, date of birth, remuneration information, and special categories of personal data (e.g., any allergies, health status, special needs).

Legal basis: Article (6)(1)(b) of the GDPR – entering into and performance of the contract; Article (6)(1)(f) of the GDPR – a legitimate interest in ensuring the performance of contracts and compliance with occupational safety requirements; Article (9)(2)(a) of the GDPR – consent of the data subject when processing special categories of personal data necessary for the role; Article (9)(2)(h) of the GDPR – processing special categories of personal data is necessary to ensure compliance with health care or occupational safety requirements.

Personal data storage period: 10 years after termination / expiry of the contract.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, contractors / suppliers, the SODRA [2], VMI [3], legal service providers, auditors, insurance companies, the financial services company, payment service providers, casting agencies, health care institutions.

Processing of personal data of child actors and / or their parents / representatives

What we process: personal data of child actors and their parents / representatives, chaperones of children for the purpose of Project implementation, contract performance, ensuring special needs and adapting the working environment. The following personal data is processed (including, but not limited to): the child actors’ name, surname, date of birth, and special categories of personal data (e.g., any allergies, health status, special needs); the following personal data of their parents / representatives: the name, surname, contact information; contact details of representatives of educational institutions for organisation of education; the chaperones’ contact details, certificates evidencing that they have no convictions for sexual and other serious crimes, the code for legal work with children. 

Legal basis: Article (6)(1)(b) of the GDPR – entering into and performance of the contract; Article (6)(1)(c) of the GDPR – a legal obligation (Article 30(1) of the Law of the Republic of Lithuania on Fundamentals of Protection of the Rights of the Child); Article (6)(1)(f) of the GDPR – a legitimate interest in ensuring the performance of contracts and compliance with occupational safety requirements; Article (9)(2)(a) of the GDPR – consent of the data subject when processing special categories of personal data necessary for the role; Article (9)(2)(h) of the GDPR – processing special categories of personal data is necessary to ensure compliance with health care or occupational safety requirements.

Personal data storage period: 10 years after termination / expiry of the contract. 

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, contractors / suppliers, the SODRA (State Social Insurance Fund Board), VMI (State Tax Inspectorate), legal service providers, auditors, insurance companies, the financial services company, payment service providers, casting agencies, educational institutions, health care institutions.

Processing of personal data of team members and / or their representatives 

What we process: personal data of candidates / job applicants, team members and / or their representatives for the purpose of Project implementation, selection of team members, entering into contracts, issuance of powers of attorney and pay administration. The following personal data is processed (including but not limited to): the name, surname, date of birth, personal ID number, ID document number, phone number, e-mail address, bank account number, signature, education, work experience and references, the number of the individual activity certificate or business certificate (of independent contractors), special categories of personal data (e.g., any allergies, health status, special needs).

Legal basis: Article (6)(1)(b) of the GDPR – performance of the contract; Article (6)(1)(f) of the GDPR – a legitimate interest in ensuring entering into and performance of contracts; Article (9)(2)(h) of the GDPR – processing special categories of personal data is necessary to ensure compliance with health care or occupational safety requirements.

Personal data storage period: 10 years after termination / expiry of the contract.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, contractors / suppliers, the SODRA (State Social Insurance Fund Board), VMI (State Tax Inspectorate), legal service providers, payment service providers, auditors, insurance companies, the financial services company, health care institutions.

Processing of personal data of business entities’ representatives and employees

What we process: personal data of representatives and employees of business entities for the purpose of Project implementation, contract performance, administration of authorisations and remuneration. The following personal data is processed (including, but not limited to): the name, surname, phone number, e-mail, signature, the number of the individual activity certificate or business certificate (of independent contractors).

Legal basis: Article (6)(1)(b) of the GDPR – performance of the contract; Article (6)(1)(f) of the GDPR – a legitimate interest in ensuring entering into and performance of contracts.

Personal data storage period: 10 years after termination / expiry of the contract.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, contractors / suppliers, the VMI, legal service providers, payment service providers, auditors, insurance companies, the financial services company.

Processing of personal data of individuals not classified under the above mentioned categories of entities

What we process: personal data of individuals for the purpose of Project implementation, contract performance, administration of authorisations and remuneration. The following personal data is processed (including, but not limited to): the name, surname, phone number, e-mail, signature, personal code.

Legal basis: Article (6)(1)(b) of the GDPR – performance of the contract; Article (6)(1)(f) of the GDPR – a legitimate interest in ensuring entering into and performance of contracts.

Personal data storage period: 10 years after termination / expiry of the contract.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, contractors / suppliers, the VMI, legal service providers, payment service providers, auditors, insurance companies, the financial services company.

Compliance with occupational safety requirements, and investigations of incidents

What we process: Personal data of Project participants and / or their representatives to ensure compliance with occupational safety requirements and investigate incidents. The following personal data is processed (including, but not limited to): the name, surname, position (job title), contact details, signature (in case of safety talk / instructions), injury and health information.

Legal basis: Article (6)(1)(c) of the GDPR – a legal obligation; Article (9)(2)(b) of the GDPR – a legal obligation in the field of employment and social security and social protection law.

Personal data storage period: based on the Index of Retention Periods for General Documents.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, health care institutions, insurance companies, legal service providers, auditors, State-owned companies (in the event of a serious incident).

Organization of business trips

What we process: personal data of the persons going on business trips for the purpose of Project implementation and organization of business trips. The following personal data is processed (including but not limited to): the name, surname, position (job title), personal ID number, e-mail, phone number, ID document information.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in organising business trips.

Personal data storage period: 10 years.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, hotels, airlines, tour operators, embassies, financial services company, payment service providers, insurance companies.

Processing and transmitting the footage

What we process: footage and metadata for the performance of the contract with the Project client (Producer), data security and quality assurance, backups and secure data transfer. The following personal data is processed (including, but not limited to): the image and sound / voice of a person recorded on a tangible medium.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests to ensure performance of the contract with the Project client and the processing of footage.

Personal data storage period: until the end of the Project.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, IT (DIT) specialist.

Monitoring the use of personal mobile devices

What we process: Personal data of Project participants using personal mobile devices for the implementation of the Project. The following personal data is processed: IP addresses of the devices if the device is connected to the Project client’s computer network.

Legal basis: Article (6)(1)(a) of the GDPR – consent; Article (6)(1)(f) of the GDPR – legitimate interests in ensuring the confidentiality and security of data.

Personal data storage period: until the end of the Project.

Recipients of personal data: IT maintenance services company.

Administration of online meetings

What we process: the online meeting participants’ names, surnames, e-mail addresses, IP addresses, device information, the start and end times of online meetings, also the video, audio and presentation recordings in the case of recording.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in organising online meetings; if the online meeting is filmed, then Article (6)(1)(a) of the GDPR (consent) applies.

Personal data storage period: based on the settings of the online meeting platform.

Recipients of personal data: IT maintenance service company, online meeting platforms, other participants in online meetings.

Providing wireless Internet (Wi-Fi) access

What we process: the Wi-Fi users’ data to provide wireless Internet (Wi-Fi) access. The following personal data is processed: the login time, IP address, device MAC address, the type of device used, volume of data traffic, network services used (e.g., DNS queries, websites visited).

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in enabling access to the Internet.

Personal data storage period: until the end of the Project.

Recipients of personal data: IT maintenance service company.

Financial accounting

What we process: personal data of Project participants for the purpose of handling financial accounting. The following personal data is processed (including, but not limited to): the name, surname, address, bank account number, e-mail address, the number of the individual activity certificate or business certificate (of independent contractors) and taxpayer identification number, signature of the Project participants / their representatives.

Legal basis: Article (6)(1)(b) of the GDPR – performance of the contract with a data subject; Article (6)(1)(c) of the GDPR – a legal obligation (Article 7 of the Law of the Republic of Lithuania on Financial Accounting), and Article (6)(1)(f) of the GDPR – legitimate interests in handling the financial accounting.

Personal data storage period: 10 years.

Recipients of personal data (including but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, the SODRA (State Social Insurance Fund Board), VMI (State Tax Inspectorate), financial accounting firm, payment service providers, auditors.

Vehicle protection and fuel limit control

What we process: personal data of the Project participants who are reimbursed for fuel costs and / or who use the vehicles provided by the Project Company (including, but not limited to): the name, surname, phone number, licence plate number, route, GPS tracking data.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in reimbursing and controlling fuel costs and ensuring the protection of vehicles; if the car is personal, then Article (6)(1)(a) of the GDPR (consent) applies.

Personal data storage period: 10 years (documents justifying fuel costs, journey forms).

Recipients of personal data (including but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, the VMI (State Tax Inspectorate), financial accounting firm, auditors, car rental, insurance companies, GPS device rental company.

Control of the limit on the cost of telephone services

What we process: personal data of Project participants who are reimbursed for the costs of telephone communications services (including, but not limited to): the name, surname, phone number, data on the use of telephone communications

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in reimbursing and controlling the costs of telephone communications.

Personal data storage period: 10 years (documents justifying the cost of telephone services).

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, the VMI (State Tax Inspectorate), financial accounting firm, auditors, telephone service providers.

Access control and alarm system

What we process: access (entry), alarm codes and / or the name, surname and phone number of persons with access permits.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in ensuring the safety of property and persons.

Personal data storage period: until the end of the Project.

Recipients of personal data (including, but not limited to): the Project client and members of the Project client’s team, the security services company.

Examination of requests, complaints, notifications of individuals

What we process: the name, surname, position (job title), contact details, work functions and signature of the persons submitting requests, complaints or notifications, their addressees and drafters of documents, also the content of documents.

Legal basis: (6)(1)(c) of the GDPR – a legal obligation.

Personal data storage period: based on the Index of Retention Periods for General Documents.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, addressees, legal service providers, auditors.

Ensuring prevention of violence and harassment, investigating reports of violations

What we process: personal data for the purpose of preventing violence and harassment, investigating reports of violations. The following personal data is processed: the name, surname, position (job title), contact information of the persons reporting an incident, potential victims, persons against whom a complaint is made and / or suspected persons, witnesses and persons who carried out the investigation, details of the incident, information related to the violation and findings of the investigation.

Legal basis: (6)(1)(c) of the GDPR – a legal obligation.

Personal data storage period: 1 year after the decision / resolution.

Recipients of personal data (including but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, addressees, legal service providers, auditors, law enforcement authorities and government agencies.

Application of tax benefits

What we process: personal data of representatives and auditors of the companies wishing to provide free funds for the production of the film and to benefit from tax advantages (reduction of taxable income and corporate income tax): the name, surname, position (job title), signature, phone number and e-mail.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests in the performance of a contract aimed at obtaining funds for the production of the film.

Personal data storage period: 10 years.

Recipients of personal data (including, but not limited to): the film producer and members of the film producer’s team, the Project client and members of the Project client’s team, auditors, investing companies, Lithuanian Film Centre.

Visibility promotion (social media administration)

We, along with social media platforms, manage our accounts on social media. The information you provide on social media or that is obtained when you visit the Company’s accounts is controlled by the social media operators. Therefore, we recommend that you should read the privacy statements of the social media operators. The following personal data is processed: the profile data of visitors of the social media, Like, Follow clicks, comments, sharing.

Legal basis: Article (6)(1)(f) of the GDPR – legitimate interests of the data controller to increase the Company’s visibility.

Personal data storage period: based on the policy established by the social media platform.

Recipients of personal data: social media operators with whom the Company acts as joint data controllers.

Personal data recipients and processors

We may transfer your personal data to the data recipients indicated above in connection with specific purposes, taking into account the basis of the data provision and ensuring security of the data transferred. In addition, we may transfer your data to the following recipients: law enforcement authorities; legal service providers; third parties (including, but not limited to): the Company’s production partners, entities / persons financing the film production, other professional consultants, accountants, payment service providers, legal and regulatory authorities, service providers (including, but not limited to insurance service providers, IT service providers, cloud storage providers and business travel service providers), broadcasters, distributors, agencies, advertisers and other persons associated with your obligations under your contract.

Any data processing takes place in line with the instructions of the Company and the data processing agreement or legal acts, providing only the necessary access.

Data transfers outside the EU / EEA 

As a rule, we process and store personal data of data subjects in the territory of the European Union (EU) or the European Economic Area (EEA).

Your personal data may be transferred, stored and processed outside the EEA, where data protection rules may not provide the same protection as applicable in the EEA. The Company will transfer your personal data outside the EEA in accordance with the requirements of Chapter V of the GDPR: if (i) such a transfer takes place in a country or jurisdiction that has been approved by the European Commission as having an adequate level of protection; (ii) appropriate safeguards are applied in accordance with data protection legislation, (iii) there is an applicable exception (for example, we have your explicit consent or the transfer is necessary for the Company to perform its obligations under your contract, or the transfer is necessary for the Company to be able to perform its obligations under a contract to which you are not a party, but which is beneficial to you (e.g., to provide your personal data to a film broadcaster, the entity / person financing the film production, and / or a distributor).

Profiling and automated decision-making

The Company does not carry out profiling and automated decision-making that would entail significant consequences for you or would have a significant impact on you.

Rights that you have as a data subject

As a data subject, you have the following rights: to know (be informed) about the processing of your personal data (Articles 12-14 of the GDPR); to access the processed personal data concerning you (Article 15 of the GDPR); to request rectification of inaccurate personal data concerning you (Article 16 of the GDPR); to request the erasure of personal data concerning you (“right to be forgotten”) (Article 17 of the GDPR); to restrict data processing (Article 18 of the GDPR); to transfer personal data (“right to data portability”) (Article 20 of the GDPR); to object to the processing of personal data (Article 21 of the GDPR); to withdraw the given consents (Article 7(3) of the GDPR); to lodge a complaint to the State Data Protection Inspectorate or the competent court (Article 12(4) of the GDPR).

If you are concerned about the Company’s actions / omissions which, in your opinion, may lead to potential non-compliance with the requirements of this Privacy Statement or legal acts, you may contact the Company using the contact details indicated in this Privacy Statement.

The Privacy Statement was last updated on December 10, 2024.

[1] The GDPR is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance).
[2] SODRA is the State Social Insurance Fund Board under the Ministry of Social Security and Labour.
[3] VMI is the State Tax Inspectorate under the Ministry of Finance of the Republic of Lithuania.