IN THIS SECTION OF THE PRIVACY POLICY, WE INFORM YOU HOW THE COMPANY, AS A DATA CONTROLLER, PROCESSES YOUR PERSONAL DATA.
1. On whose behalf does the Company act?
The Company, acting as a data processor, operates on behalf of the following data controller at the time of preparation of this Privacy Policy: a closed-ended type collective investment undertaking for informed investors, private limited liability company ORION Healthcare and Wellness Fund, legal entity code 304143422, registered address Antano Tumėno g. 4-38, Vilnius.
Hereinafter in this part of the Privacy Policy, the closed-ended type collective investment undertaking for informed investors, private limited liability company ORION Healthcare and Wellness Fund shall be referred to as the investment company.
2. What processing of personal data has been entrusted to the Company?
2.1 Scope of personal data, purposes, and other information regarding the processing of personal data:
The management of the above-mentioned company, as a collective investment undertaking, has been delegated to the Company. Accordingly, the investment company referred to in point 1 of this part of the Privacy Policy exercises its rights and obligations in the area of personal data processing through the Company, meaning that the Company processes personal data in full on their behalf and carries out all personal data processing activities.
Detailed information on the personal data processing carried out on behalf of the closed-ended type collective investment undertaking for informed investors, private limited liability company ORION Healthcare and Wellness Fund is available here.
2.2 Transfer of data to third countries
When processing personal data on behalf of the investment company, we use Microsoft products and services and have entered into a data processing agreement with Microsoft Ireland Operations Limited (Ireland). In the course of providing these services, there may be instances where data is transferred to third countries. In such cases, the Standard Contractual Clauses approved by the European Commission (module "processor to processor"), agreed upon by Microsoft Ireland Operations Limited and Microsoft Corporation, shall apply to ensure the protection of your personal data. These clauses apply to the transfer of personal data from the European Economic Area to third countries that do not ensure an adequate level of personal data protection, as provided for in Article 46 of the GDPR and the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. In addition, on 10 July 2023, the European Commission adopted an adequacy decision under the EU–US Data Privacy Framework, pursuant to which personal data may be transferred to certified US organizations.
2.3 Receipt and disclosure of data
Your personal data recipients also include our engaged sub-processors, who are bound by the same obligations as we are as data processors. More detailed information is available here. General overview applies in full.
3. What rights do you have?
This section provides information about your rights in relation to the processing of your personal data carried out on behalf of the investment company, and the circumstances under which you may exercise these rights.
Please note that data subject requests and responses thereto are handled by us. If you wish to obtain further information about your rights or to exercise them, please contact us at: dpo@nteram.lt.
We ensure that you are able to exercise your rights and information is generally provided free of charge. We will, without undue delay and no later than 1 (one) month from the receipt of the request, provide you with information on the actions taken in response to your request regarding the exercise of your rights. Depending on the complexity of the request and the number of requests received, the aforementioned period may be extended by a further 2 (two) months. In such a case, we will inform you within 1 (one) month of receipt of the request of such extension and the reasons for it. We will refuse to implement your rights only in cases provided for by law.
3.1 Right of access to your personal data
We aim to ensure that you fully understand how the investment company referred to in this part of the Privacy Policy processes your personal data, and that you experience no inconvenience as a result. Information on how we process your personal data is primarily provided in this part of the Privacy Policy. Nevertheless, you may contact us at any time to enquire whether we process any of your personal data on behalf of the investment company. If we process or use your personal data in any way on behalf of the investment company, you have the right to access it. To do so, please submit a written request to us at dpo@nteram.lt and confirm your identity (where such confirmation is required in the specific case).
3.2 Right to withdraw your consent
If you have provided explicit consent to the investment company for the processing of your data, you may withdraw it at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent carried out prior to its withdrawal.
3.3 Other rights
The following sets out information on your other rights, which you may exercise in accordance with the procedure described below.
a) You have the right to request that we correct any inaccuracies in the data we hold. In such cases, we may ask you to confirm the corrected information.
b) You have the right to request that we erase your personal data. This right may be exercised in the cases provided for in Article 17 of the General Data Protection Regulation (EU) 2016/679.
c) You have the right to request that we restrict the processing of your personal data or cease processing it:
- during the period required to verify the accuracy of your personal data when you raise objections regarding data accuracy;
- where our collection, storage or use of your personal data is unlawful, but you choose not to request its erasure;
- where your personal data is no longer necessary for our purposes, but you require it for the establishment, exercise or defence of a legal claim;
- during the period required to determine whether we have a compelling legitimate ground to continue processing your personal data, where you have exercised your right to object to the processing of personal data.
d) You have the right to data portability in respect of data processed by automated means, which you have provided to us in a structured, commonly used and machine-readable format, on the basis of your consent or for the purpose of entering into a contract. Upon exercise of this right, at your request we will transfer a copy of the data you have provided to you or to a data controller of your choice.
e) You have the right, in the manner provided for in Article 21 of the GDPR, to object to our use of your personal data, for example where we process your personal data on the basis of our legitimate interests.
f) You have the right to object to the processing of data for direct marketing purposes. Where we process your personal data for direct marketing purposes, you have the right to object at any time to the use of your personal data, including profiling related thereto. In such a case, we will no longer process your personal data for these purposes.
3.4 Right to request more information
We endeavour to provide the clearest and most comprehensive information possible regarding the investment company's processing of personal data and undertake to update this part of the Privacy Policy whenever the personal data processing practices change. However, if you have any questions regarding the processing of your personal data, we will be happy to answer them or provide all additional information that we are able to disclose. Should you have any specific questions or have not understood the information provided, please contact us.
4. Complaints
If you believe that your rights as a data subject have been or may be infringed, please contact us immediately by email at dpo@nteram.lt. We undertake to contact you within a reasonable period upon receipt of your complaint and to keep you informed of the progress of the complaint investigation and subsequently of its outcome.
You always have the right to lodge a complaint with the supervisory authority — the State Data Protection Inspectorate: https://vdai.lrv.lt/.