Public Institution “BMI Executive Institute” (hereinafter – BMI) processes personal data in compliance with the European Union General Data Protection Regulation (hereinafter – the GDPR), Law on Legal Protection of Personal Data of the Republic of Lithuania, Law on Electronic Communications of the Republic of Lithuania and other legal requirements. In this Privacy Policy (hereinafter – the Policy) you will find answers to the most important questions on how we collect, use and store information related to you. This Policy can be amended or updated at any time.

We process personal data of all members of BMI community: current and former employees, students and alumni, lecturers, professors and other individuals who have provided information on the basis of contract, consent or other legal relations as defined by law.
Our Privacy Policy describes, among other matters, what data and for what purposes are collected, how you can manage your data and how to contact us.

What is personal data?

Personal data – any information related to an individual that can be used to determine his/her identity either directly or indirectly by reference to factors of physical, physiological, mental, economic, cultural or social nature. Personal data includes, for example, a person’s name, surname, residence address, visual image, personal code, fingerprints, retina scan, telephone number, email address, IP address, vehicle registration number, etc.

What is data processing?

Data processing – any operation or set of operations carried out with personal data: collection, recording, storage, grouping, combination, alteration, publication, search, destruction, etc. Data can be processed manually or by electronic means: computers, telephones, tablets, video recorders, photo cameras, etc.

What is a data subject?

Data subject – any individual whose personal data is processed.

What is a data controller?

Data controller is an organization or individual who uses personal data for professional purposes. The controller determines the purposes of personal data processing and methods how personal data is processed. BMI is the data controller and responsible for your data security.

What is a data processor?

Data processor is an organization or individual who performs data processing operations on behalf of the data controller under the instructions of the data controller. We have the right to conclude data processing agreements with other individuals or legal entities.

What are the legal grounds for personal data processing?

• We have your consent (GDPR Article 6 (1) (a))
• We conclude contracts with you or already are in a contractual relationship (GDPR Article 6 (1) (b))
• We have a legal obligation to process personal data (GDPR Article 6 (1) (c))
• We protect the vital interests of you and other natural persons (GDPR Article 6 (1) (d) and Article 9 (2) (c))
• We have legitimate interests/purposes to do so (GDPR Article 6 (1) (f))

Where from does BMI get personal data?

We get personal data mainly from data subjects. Also, we may get personal data from other sources, such as private and public registers, social media, Social Insurance Fund, as well as from other persons and/or legal entities, when personal data is obtained following the contractual or legal requirements.
When personal data is provided to us by other persons and/or legal entities, we consider that this is done with the knowledge of data subjects and their consent or legal requirements.
When you provide personal data of another person to us, you must make sure that you have informed that person about this fact and make reference to how we process his/her personal data.

How is personal data protected?

We have implemented relevant physical and technical measures to protect personal data:

• Access to personal data is restricted to our authorised employees;
• Our authorised employees are periodically trained on personal data processing and relevant laws;
• Tools for electronic data protection are applied, e.g. intrusion detection and prevention systems, protection against attacks, firewalls, data encryption, etc.;
• Data is periodically backed up, back-up copies are kept apart from the source, the same security measures are applied for the back-up;
• Hard copies of documents are stored in specially designated places with restricted access to our authorised employees. Archiving service provider that meets the highest security requirements delivers long-term storage of hard copies of documents.

What are the purposes for personal data processing?

We process personal data for the following purposes:

• BMI internal administration
• Recruiting
• Application process handling
• Reference process handling
• Study process organisation and administration
• Conclusion of copyright agreements
• Communication with employees, students, and alumni
• Managing of BMI intranet accounts
• Organization of conferences and events
• Investigation of complaints and requests
• Video and audio monitoring
• Marketing

What are the groups of data subjects, what personal data do we process, and how long do we store personal data?

Data subject	Personal data / Purpose / Basis	How long do we store personal data?
Actual and former employees	Name(s), surname(s), citizenship, address, personal code, number(s) of passport and/or personal identity card, date of issue, date of expiry, authority issuing the document, document registration date and number, date of birth, gender, photo, signature, marital status, names and surnames of family members under 18 years of age, social insurance (certificate) number, sums of wages and social insurance contributions, data about participation in pension schemes, bank account number, tel. number, email address, CV, job position, data about recruitment (transfer) and dismissal, work experience, data about education and qualifications, academic titles, date of data input (modification), data about vacations, data about business trips, data about individual work schedule, data about payroll, benefits, compensations, allowances, information about work periods, information about incentives and penalties, specific personal data related to a person’s health, accidents in workplace data, data about criminal conviction (for specified positions), previous employment and position(s), former surname (if applicable), other personal data provided by the person, content of the employee’s computer, telephone and other electronic devices, content of e-mail and other communication programs, browsing history. Purpose: internal administration. Basis: contract, legal obligation, legitimate interest.	10 or 50 years after the termination of employment agreement – according to legal requirements (50 years for: payroll calculation data, employment contract data, data of accidents in the workplace).
Students	Name(s), surname(s), citizenship, address, personal code, number(s) of passport and/or personal identity card, date of issue, date of expiry, authority issuing the document, document registration date and number, date of birth, gender, photo, signature, tel. number, email address, lecture attendance, exam grades, presentations, essays prepared during the studies, membership in organizations, BMI intranet username, participation in BMI events, information on received student books. Purpose: conclusion and execution of student contracts. Basis: contract.	10 years after the termination of the study contract
Students and lecturers (E-learning platform)	Name, surname, company, position, industry, nationality, photo, student exams, grades, video recordings of lectures, comments and messages. Purpose: conclusion and execution of student contracts, administration of e-learning platform. Basis: contract, legitimate interest.	10 years after the termination of the study contract
Students and Alumni	Name, surname, class, diploma paper contents. Purpose: allowing other Students or Alumni to familiarize with the diploma paper. Basis: consent.	–
Students and Alumni	Name, surname, personal code, gender, passport or ID card number, dates of issue and validity of passport / ID card, address, date of birth, e-mail, tel. number, employer, position, employment experience, education, year of graduation, homework and essays, titles of diploma papers, photo, membership in organizations, BMI intranet username. Purpose: administration of BMI intranet accounts. Basis: contract, consent.	10 years
Recruitment applicants/candidates	Name(s), surname(s), photo (if provided by the person), tel. number, e-mail, current and previous employer and position, date of birth (if provided by the person), education, academic degree, other information submitted by the applicant/candidate. Purpose: recruitment. Basis: consent.	During the recruitment period or 2 years if the consent has been submitted
Applicants who undergo application process	Name, surname, date of birth, sex, citizenship, address, telephone number, e-mail, postal address, copy of identity document, diplomas, languages, current job position, responsibilities and duties, previous work experience, international experience (studies and work), membership in organizations, research papers, diplomas, documents confirming knowledge of English, documents confirming payment of the application fee, photographs. Purpose: evaluation of application and candidate selection. Basis: contract.	10 years after application submission or study contract termination
Referees of the applicants	Name, surname, employer, position, tel. number, e-mail, answer to the questions in reference form. Purpose: evaluation of application and candidate selection. Basis: consent.	10 years after the termination of study contract
Persons who submitted requests in “write to us” section in BMI website	Name, surname, tel. number, e-mail, message text. Purpose: administration of submitted requests. Basis: consent.	3 years
Persons who agreed to receive direct marketing information	Name, surname, tel. number, e-mail. Purpose: direct marketing. Basis: consent.	5 years, unless the consent is withdrawn earlier
Authors in the copyright agreements	Name, surname, personal code, address, tel. number, e-mail, bank account number, photo, video/ audio records, other information needed for copyright agreement execution. Purpose: conclusion and performance of contracts. Basis: contract.	50 years after the termination of the contract – personal data indicated in the contract.
BMI website visitors	Browsing history/actions/selections, consents, etc. Purpose: administration of the website Basis: legitimate interest, consent	Cookies creation/expiry rules indicates in cookies policy.
Event participants	Data provided during registration (name, surname, contact details, company, position, country of residence, interest in pursuing a degree in BMI) as well as video and sound recording (in case of online events). Purpose: organization of events. Basis: consent.	1 year active processing (historical posts and data are not deleted)
BMI website visitors requesting registration	Name, surname, email address, direct marketing preference. Purpose: registration of interested parties. Basis: consent	1 year

To whom personal data may be disclosed to?

Your personal data may be provided to third parties who process your personal data in order to help us administrate our website and protect your personal data. Such third parties may include database software vendors, database management services providers, cloud service providers, etc. Your personal data may also be provided to the authorities of law enforcement agencies, such as police or supervisory authorities, but only upon request and only when required by applicable law or in order to protect our rights or to ensure the security of our customers, employees and resources.

Your personal data may be disclosed to any other party upon your request.

In cooperating with educational institutions outside the European Economic Area (EEA) personal data may be disclosed to non-EEA countries. In such cases we shall require personal data receivers to process personal data complying with EU regulations and to ensure personal data safety.

What are cookies?

Cookies are small text files stored on the bowser of your device (e.g., computer, mobile phone or tablet PC) while you navigate in a website. Depending on the browser, this information is stored either in small individual files or in a common file of cookies stored by different websites. Cookies are used to capture the pages of the website you have viewed, to save the information you have entered, and to remember your choices.

Why do we use cookies?

We use cookies to help us provide you with a personalized experience. They help us to recognize you when you return to our website, to collect information about your use of the website and to tailor the content of the website to your interests. Cookies also help us to ensure the proper functioning of the website, to monitor the duration and frequency of visits to www.bmiinstitute.com website, and to collect statistical information about the number of the website users. By analysing this information, we can improve the performance of our website and your user experience. When you visit www.bmiinstitute.com website, you can select whether you want to accept cookies. If you do not wish to receive cookies on your computer or other device, you can withdraw your consent at any time by changing your browser settings and delete cookies that have already been saved.

What cookies do we use?

Name	Description	Creation / Expiry times
CMSSESSIDX	A standard cookie used to manage the user’s session.	Upon opening the website/ until the user closes the website
cookiesAgree	A cookie which records whether you have consented to the use of cookies on our website.	From the time of consent/until it is deleted
cookiesLevelX	A cookie identifying the types of cookies you have accepted on our website.	From the time of consent/until it is deleted
_ga	This cookie is used by Google Analytics to assess the purpose of the user’s visit, generate reports on the website activity to website operators, and improve user’s experience when browsing on the website.	From the time of consent/ 2 years.
_gat	This cookie is used by Google Analytics to collect statistical information about the website traffic.	Upon the first visit to the website/ until the end of the session
_gid	This cookie is used by Google Analytics to distinguish you from other users.	Upon the first visit to the website/2 days

If you want to learn more about cookies and how to manage or delete them, please visit http://www.allaboutcookies.org. 

If you want to learn how to disable website tracking using Google Analytics cookies, please visit http://tools.google.com/dlpage/gaoptout. 

What are the types of cookies?

Cookies include session cookies and long-term cookies as well as first-party and third-party cookies. The definitions of these terms are provided below so that you can have a better understanding of the nature and purpose of our cookies. 

Session cookies

Session cookies allow users to be recognized for the duration of a single session so that any page changes or item selection are remembered when they move from page to page. These cookies make navigating across numerous website pages faster and easier, because there is no need to repeatedly process the information when a new page is opened. Session cookies are temporary and disappear once you close your browser or log off the website.

Long-term cookies

Long-term cookies are stored on your computer for a specified period of time following the end of your session and they may record specific user settings or actions when the user returns to the website.

First-party cookies

These cookies are essential to the proper functioning of www.bmiinstitute.com website.

Third-party cookies

These are the cookies operated by other organizations via our website. In our case, the Google Analytics cookies used on www.bmiinstitute.com website are utilized to analyze the website traffic. Google Analytics collects anonymous information about the number of users, the location from which our website has been accessed, and the parts of the website browsed by the users. These cookies are created by Google Analytics. To learn more about Google Analytics, please visit http://www.google.com/analytics.

Any information collected using cookies is stored until these cookies expire and are not used for any purpose other than those listed in this policy.

Our website contains links to other websites operated by individuals, companies or organizations. Please note that bmiinstitute.com is not responsible for the content or privacy practices of linked websites. When you click on these links and enter these other websites, you should review the privacy policies which may apply to these websites.

Social Media 

By using our social media platforms, such as Facebook and LinkedIn, you provide us with your personal data that we process based on our legitimate interest in informing and communicating with our followers and visitors on social media platforms. 

We, together with social media platforms, namely Facebook and LinkedIn, act as joint controllers of your personal data following the decision of the Court of Justice of the European Union in the case C-210/16.

Facebook	Linkedin
Joint Controllers: Facebook Ireland Ltd. 4 Grand Canal Square Grand Canal Harbour Dublin 2, Ireland and Public Institution “Baltic Management Institute” Konstitucijos ave. 7, LT-09308 Vilnius, Lithuania	Joint Controllers: LinkedIn Ireland Unlimited Company Wilton Place Dublin 2, Ireland and Public Institution “Baltic Management Institute” Konstitucijos ave. 7, LT-09308 Vilnius, Lithuania

We use Facebook and LinkedIn to draw attention to our activities and to communicate with you as visitors to those pages. More information about our activities can be found at www.bmiinstitute.com. The operation of these social media platforms, including the processing of visitors’ personal data, is based on our legitimate interest in informing and communicating with our followers and visitors on social media platforms.

As joint controllers, we may process such data as photographs, video and audio recordings, your communication on our websites, etc. Such personal data may be processed for the following purposes:

• Advertising (analysis, provision of personalized advertising);
• Creating user profiles;
• Market Research.

Since only Facebook and LinkedIn have complete access to the user data, we recommend that you address Facebook and / or LinkedIn directly if you have information inquiries or questions regarding your rights as a user (e.g. right to erasure). If you need support in doing so or if there are other questions, do not hesitate to contact us:

If you do not wish to have your data processed like this in future, please use the “Unlike” function in order to disconnect your user profile from our page.

What are your rights?

You have these rights in relation to your personal data:

• to request that we would allow access to personal data and correct or delete it, or to limit the processing of data;
• the right to object to the data processing;
• the right to receive your personal data in a structured, commonly used and machine-readable format (the right to data portability);
• the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;
• the right to lodge a complaint to the State Data Protection Inspectorate https://vdai.lrv.lt/.

You have the right to object to processing at any time free of charge in so far as it relates to direct marketing.

In order to exercise the above rights please contact us by email info@bmiinstitute.com or by post (address PI „Baltic Management Institute“, Konstitucijos av. 7, LT-09308 Vilnius). While applying with your request, please provide evidence for your personal identification and indicate which of the rights you would like to exercise. 

We shall respond to you not later than 1 month from the date of receipt of your request under condition that answering the request does not require additional recourses and the request itself is submitted properly. If the request requires complex actions, we may extend the deadline to 3 months in total. In such a case, we will inform you of such extension.

Changes in This Privacy Policy 

Should we make amendments to Privacy notice, we will place the amended notice on our websites, with an indication of the amendment date. If the amendments are significant, we will also try to inform you about this before thirty (30) calendar days in advance by other means, for example by sending an e-mail and/or placing a bulletin on our homepage. We recommend that you review Privacy notice from time to time to ensure you are aware of any amendments made.

Contact Information

Should you have any questions, please contact us at info@bmiinstitute.com or 370 674 37487.