Privacy Policy and Cookies

In this section, we provide information about your rights related to the processing of your personal data by us and the cases when you can exercise these rights. If you would like to receive more information about your rights or exercise them, please contact us in this Privacy Policy. to the postal address.

The company will provide you with information about the actions taken after receiving your request for the exercise of your rights without unreasonably, but no later than within 1 (one) month of receiving the request. Depending on the complexity of the application and the number of requests received, the said term can be extended for another 2 (two) months. In this case, we will inform you within 1 (one) month from the receipt of the request about such extension of the term and its reasons. The company will refuse to exercise your rights only in cases provided for by legislation.

We recommend using this request to exercise data subject rights form.

We aim for you to fully understand how we use your personal data and not experience any inconvenience as a result. We first provide information about how we process your personal data in this Privacy Policy (right to be informed). You can contact us at any time and ask if we process any of your personal data. If we store or use your personal data in any way, you have the right to access it. To do this, submit a written request to us in the e-mail address specified in this Privacy Policy. e-mail address, confirm your personal identity (if such confirmation is required in a specific case).

If you have given us express consent to the processing of your data, you can withdraw it at any time. The withdrawal of consent does not affect the legality of consent-based data processing carried out before the withdrawal of consent.

Below we provide information on the additional rights you have that you can exercise in accordance with the procedure described below.

1. You have the right to ask us to correct any inaccuracies in the available data. In this case, we may ask you to confirm the corrected information.
2. You have the right to ask us to delete your personal data. This right is exercised in the cases provided for in Article 17 of the GDPR.
3. You have the right to ask us to restrict the processing of your personal data or not to process it:

• during the period required to ensure the accuracy of your personal data when you make claims about data accuracy;
• when the collection, storage or use of your personal data is illegal, but you decide not to ask for data deletion;
• when your personal data is no longer needed by us, but you need it to identify, fulfill or defend a legal requirement;
• period, which is necessary to determine whether we have a more important legal basis to continue processing your personal data, if you have exercised your right to express your objection to the processing of personal data.

1. You have the right to disagree (oppose) in accordance with the procedure established in Article 21 of the GDPR, so that we use your personal data. You have the right to disagree (object) when your personal data is processed on the basis of legitimate interest (for each purpose of data processing specified in the Privacy Policy, it is indicated on what basis the data is processed) or for the purpose of direct marketing.
2. You are entitled to the transfer of data that is processed by automated means and which we have received from you in a structured, commonly used and computer-readable format with your consent or for the purpose of concluding a contract. After you have exercised this right, we will transfer a copy of the data you provide to you or the data controller of your choice at your request.

We hope that you will understand that it is very difficult to discuss all possible ways of collecting and using personal data. We try to provide the clearest and most detailed information possible and undertake to update this Privacy Policy in the event of a change in the process of using personal data. However, if you have any questions about the use of your personal data, we will be happy to answer them or provide you with all the additional information we can disclose. If you have any specific questions or do not understand the information provided, please contact us.

When obligations under the concluded contracts are not fulfilled and debts are not paid within the set deadline, for the purpose of debt collection, we transfer debtors’ data to debt collection companies, bailiffs, and courts in order to start the debt collection process.

For the purpose of debt collection, based on our legitimate interests: to ensure the management of debts and damage to the company and their collection (GDPR Article 6, paragraph 1, point f) we will process the personal data of employees of natural persons and clients of legal persons or authorized representatives of customers, which we process for the conclusion of contracts with clients and for the purpose of providing services (paragraph 5 of the Privacy Policy), as well as the data of natural persons of customers related to debt collection: information on how the debt is collected (judicial or pre-trial, using a debt collection company), date of debt transfer for collection, data on debts on the day of formation, debt amount, debt repayment or write-off date.

For the purpose of debt collection, personal data is stored until the full debt is settled and for 10 years after the end of this period.

Data recipients: legal service providers, bailiffs, courts.

We may decide to transfer the claim to the debt to third parties in accordance with the provisions of the Civil Code of the Republic of Lithuania. After transferring the claim to the debt, we will be obliged to transfer personal data confirming the right of claim and additional rights, including the right to interest, in accordance with Article 6.104 of the aforementioned Code.

In order to achieve the stated purpose, the company will request to provide personal data in the business partner’s identification form and to submit certain documents with the help of which the following will be collected:

1. Personal data of the manager of the business partner and other representatives, managers of intermediary companies and other representatives, other managers of companies included in the transaction, intermediaries and other natural persons included in the transaction: name, surname, position, name of the company, which is represented, basis of representation, personal identification number, date of birth, citizenship, telephone number, e-mail postal address;
2. members of the board of the business partner, the supervisory board: names, surnames, year of birth, duties;
3. data of natural persons of direct and indirect shareholders, specified in the list of shareholders: name, surname, personal identification number, place of residence or address for correspondence, number and nominal value of shares held, date of acquisition of shares, date of transfer of shares;
4. data (copy) of a document confirming the identity of a business partner (natural person);
5. Data of the business partner manager and final beneficiaries (natural persons) with 25% or more shares of the business partner: names, surnames, data (copies) of documents confirming personal identity; data of documents confirming the address of the place of residence (e.g. account of utility services);
6. data specified in the declarations of final beneficiaries;
7. a sign of whether the director of the business partner, the directors, shareholders of the shareholders, the directors of the shareholders, the final beneficiaries or the employees or family members of the company’s close directors are politically vulnerable (affected);
8. A sign of whether the director, shareholders, shareholders of a business partner, his intermediary and/or another person involved in the transaction have been involved in any law enforcement investigations into fraud, money laundering, bribery entities or sanctions entities;
9. data of the final buyer (natural person): name, surname, delivery address; 
10. The person who filled out the business partner’s identification form: name, surname, position, signature, date of filling.

We receive the specified data from a business partner, but we also carry out verification, collecting information from the following sources:

1. When searching the Internet, in the press, in the files published by the State Tax Inspectorate (((https://www.vmi.lt/evmi/mokesciu-administratoriaus-nurodymas-atsiskaityti-negrynaisiais-pinigais; https://www.vmi.lt/evmi/asmenys-nevykdantys-klaidingai-vykdantys-prievoles; In the Register of Taxpayers) in order to assess whether there is a publicly available negative information about the business partner’s shareholders, managers or representatives, which would raise doubts about the reliability of the business partner;
2. European Union sanctions lists, the list of legal entities or other organizations published by Lithuania that do not have the status of a legal entity owned or controlled by an entity subject to sanctions, the United Kingdom’s sanctions list, information on physical or legal persons, groups and organizations included in the UN ST Resolution 1373 (2001) (as amended) established on the grounds specified in terrorist actions of natural or legal persons, groups and organizations whose funds and other Financial assets must be frozen, list, etc. In this case, the representative of the business partner and/or intermediaries or other persons involved in the transaction, manager (director, board members, observer members, etc.), beneficiaries, who directly or indirectly own 50 percent or more of the shares, are checked. Persons who may have other controls): name, surname, date of birth, place of residence, citizenship.

We will process the specified personal data in order to fulfill the legal obligation provided for in paragraphs 1 and 2 of Article 4 of the Law on International Sanctions of the Republic of Lithuania, Law of the Republic of Lithuania on the Determination of Restrictions on Military Aggression against Ukraine 3³ in paragraph 4 of the article, and in pursuit of their legitimate interests – to avoid the risk of violation of sanctions or other restrictive measures and the risk of inclusion in VAT fraud (GDPR Article 6, Paragraph 1, Clause f). 

In the event that, after evaluating the collected information, we will make a decision not to start a business relationship with a potential business partner, we will protect personal data for 10 years from the date of such a decision, if we make a decision to start a business relationship, the personal data will be stored during the period of business relations and for another 10 years after they have expired. For 10 years, we store data, taking into account the general limitation period established in the Civil Code of the Republic of Lithuania, in order to defend the company’s rights and legitimate interests in the event of a dispute, and, at the request of state institutions, to prove that we comply with the obligations established by legal acts for us.. 

The recipients of your personal data will be the state institutions to which we have a legal obligation on our own initiative or, on their request. 

We carry out direct marketing only in relation to legal entities, and we process their contact details (e-mail addresses, phone numbers) only after receiving the consent of the legal entity as a subscriber of this contact data, or not with consent, if such legal entities are our customers and did not object to their use at the time of submission of contact data for the purpose of sending offers. For the purpose of direct marketing, we may also process the following personal data of you as a representative of a legal entity: name, surname, e-mail address. e-mail address, represented company, request, if they are submitted to us by the legal entity you represent, or if you submit them yourself, sending us a request. 

Your data for the purpose of direct marketing will be processed for 3 years from the time of the consent, and if we use the customer’s exception – for 3 years from the date of purchase of the service (the date of conclusion of the contract). Direct marketing messages are sent (your contact details are processed) on the basis of consent (GDPR Article 6(1)(a), and when we use the customer’s exception – on the basis of legitimate interest (to promote sales) (GDPR Article 6(1) f point). 

You have the right to refuse to receive direct marketing communications or to withdraw your consent by contacting us in the e-mail address specified in point 2 of the Privacy Policy. by mail or by clicking on the opt-out link in a direct marketing message.

In order to protect the assets of the company and/or employees, including the company’s IT systems, in order to collect evidence of law violations, criminal acts and accordingly protect the company’s rights and legitimate interests, the company conducts video surveillance in its territory and premises. Video surveillance is carried out on the basis of the company’s legitimate interest (GDPR Article 6, Paragraph 1, Clause f). During video surveillance, the company processes the following personal data: image, trajectory of movement, items owned by individuals. The data is stored for 1 month. from their recording.

The recipient of your personal data is the data processors we use – the company providing security services and the company providing the video data that store the video data.

We sometimes organize representative events (for example, career days), in which case we choose the name, surname, e-mail address of the participants of the event. We process this data with your or your representatives’ consent (GDPR Article 6, Paragraph 1, Clause a). We store the data only until the end of the event and then destroy it safely and irretrievably.

We receive the data directly from you or in some cases we can receive it from companies that provide us with advertising services, which collect data under our instructions.

If you have given us consent to process your personal data for this purpose, you can withdraw it at any time by informing us about it through the contacts specified in point 2 of the Privacy Policy. Withdrawal of your consent will not affect the legality of the processing of your personal data, carried out before the withdrawal of consent.

We collect and process your personal data: workplace, e-mail address, date of birth, address, education, surname, phone number, name, desired job, date of receipt of resume, information about your personal characteristics, work experience (last workplace, length of service in the workplace, responsibilities, other work experience), information about knowledge of foreign languages (language, reading, writing, speaking levels), ability to work with computer programs, other information presented in the resume, recommendation and/or cover letter; desired salary, during the participation in the selection for the purpose of conducting a job selection on the basis of your consent, which you express to the company or its service provider by sending your resume and/or motivation letter or by filling out the application form on the website. If you do not submit your resume and/or cover letter, we will not be able to assess your suitability for the position offered. 

If you agree, we will contact your current employer, and we will contact your former employer on the basis of our legitimate interest (to select a suitable candidate) and Article 5, Paragraph 3 of the Law on Legal Protection of Personal Data of the Republic of Lithuania in order to verify information about your qualifications. professional abilities and subject qualities (for example, work results, relationships with clients and/or colleagues, evaluation of your work, etc.). On the basis of our legitimate interest (choose the right candidate), we will also collect information from public professional social media network profiles. You can withdraw your consent at any time or, accordingly, disagree with us to contact your former employer by notifying the e-mail specified in point 2 of the Policy. by mail.

In the event that you do not express your separate consent to process your personal data, after the end of the specific job selection, we undertake to delete and/or destroy your personal data within 3 working days after signing the contract with the selected candidate or making a decision to complete the selection, except in cases where separate consent is given regarding the storage of the candidate’s personal data for the specified period. If your candidacy is not chosen, but you have given your consent to process your personal data for the purpose of offering a job in the future, we will store the data for 3 years from the end of the selection on the basis of your consent. 

On the basis of our legitimate interest, we will process data about the person specified by the candidate (name, surname, e-mail, telephone, information provided by the person) – a former or current employer or person providing a recommendation, the information provided by him – for the purpose of selection of the candidate. In this case, it is in our legitimate interest to choose the right candidate for the position we are looking for. We will destroy this data within 3 days after signing the contract with the selected candidate or making the selection decision.

The company also searches for candidates on the social network LinkedIn and other employee search websites/portals, through the recommendations of the company’s employees. The company processes the following personal data of potential candidates (persons who meet the search criteria) on the social network LinkedIn, job advertisement portals and other public sources, through the recommendations of the company’s employees for the purpose: name, surname, other information provided by the social network LinkedIn or others In the profile of the search platform, whether it is provided by an employee of the company. Personal data is processed on the basis of the company’s legitimate interest (GDPR Article 6, Paragraph 1, Clause f). Personal data is not stored separately, the selected persons are simply asked for consent to participate in the selection of the company’s employees.

We receive data directly from you, public information sources (LinkedIn, job search portals), from our employees, when they are recommended by you, employment services, recruitment agencies.

in order to have its legitimate interest in ensuring the protection of the company’s confidential information, the continuity of the company’s activities, protecting the company’s information systems from hacking and data theft, viruses, dangerous web pages, malware, copyright infringement through technical and Internet access and computer network from heavy loads, the company can review the correspondence of its employees with the contractors and the information stored in the company’s electronic equipment. In order to achieve these goals, the Company processes the following personal data of its employees and persons who send or receive letters from employees: e-mail address, name, surname, date of the sender or recipient, the content of information contained in electronic working tools. 

Data collected for confidential information protection and company information systems against hacking and data theft, viruses, dangerous web pages, malware, copyright infringement through technical and Internet access and computer network for heavy loads are protected for the purpose of defending legal claims for 4 years, taking into account the provision established in Article 1.125, Part 9 of the Civil Code of the Republic of Lithuania. When defending legal requirements, data can be provided to data recipients (data controllers) such as courts, law enforcement institutions, state institutions that resolve disputes, parties to disputes, lawyers and other entities providing legal services.

The company, on the basis of its legitimate interest (GDPR Article 6, Paragraph 1, Clause f) to defend its rights, including in the case of civil disputes, manages the names, surnames, personal identification numbers of the case, other information related to the case, publicly available information of the persons involved in the case or their employees.. 

On the basis of the company’s legitimate interests (GDPR Article 6, Paragraph 1, Clause f) also processes any personal data specified in this Privacy Policy, which are necessary for the conclusion and execution of contracts, to protect the company’s rights and legitimate interests. Given that the total statute of limitations is 10 years, the personal data we process for the purposes of concluding and executing contracts will be stored for 10 years from the end of the contracts. 

The company also processes your personal data specified in the consents regarding the processing of personal data, the data confirming the fact of consent on the basis of legitimate interests (GDPR Article 6, Paragraph 1, Clause f); personal data specified in the documents implementing the data subject’s rights or by which the Company refuses to implement them, for the purpose of protecting the company’s rights and legitimate interests and protects them for 3 years from the current year in which the processing of personal data was completed or (and) implemented (refused to implement) data subjects law, end.

in fulfilling the archiving obligation (Article 6, paragraph 1, point c of the GDPR), for archiving purposes, personal data processed for the purpose of protecting the company’s rights and legitimate interests shall be stored for 5 years from the adoption of the final decision.

When processing personal data for the purpose in question, the recipients of the data are: courts, law enforcement institutions, state institutions that resolve disputes, parties to the dispute, lawyers and other entities providing legal services.

For the purpose of internal administration (after receiving a shareholder’s request for the implementation of the right to information), the company may transfer the personal data of any personal data (which is recorded in the documents provided to the shareholder) to the shareholder. The transfer is carried out in fulfillment of the legal obligation applicable to the company (GDPR Article 6, Paragraph 1, Clause c), personal data is processed only until they are handed over to the shareholder.

There are several ways you can contact the company: by phone, e-mail. by mail, through social network accounts, the contact form on the website or by sending a letter to the address of the company’s headquarters. We accept, review and provide answers ourselves or our service providers. If you contact us, we can process the data you have given us, i.e. y. E-mail e-mail address, first name, last name (if indicated), username (if the request is sent through the social network account), workplace (if indicated), date, time, recipient, sender of the messages sent and received (when the message is addressed to you), content. 

Such data will be processed on the basis of your consent (GDPR Article 6(1)(a) in order to answer your questions and examine your proposals. You can withdraw your consent at any time. If you do not provide your contact details, it will not be possible to contact you and respond to your requests. What data is required can also be specified in the request forms themselves. 

Correspondence is stored for 1 year from the receipt of the message, except for information for the storage of which other terms are set in the Privacy Policy or legal acts.

All personal data you provide when communicating with us are used only for the above purposes and to view messages and to administer and manage communication flows. We undertake not to use your personal data in any publications without your express consent to determine your personal identity.

Please note that we may need to contact you by mail, e-mail. by mail or by phone. Please notify us of changes in your personal data.

Our website uses cookies. A cookie is a small file made up of letters and numbers that we save to your browser or your computer’s hard drive.  

We may use the types of cookies described below, but you can find a detailed and relevant list of cookies used Here.

These cookies are necessary for our website to function. The basis for the use of such cookies is Article 73, Paragraph 4 of the Law on Electronic Communications of the Republic of Lithuania. These cookies are necessary for the operation of the website and cannot be disabled in our systems. Most of the time, they are used as a response to what you do on the site, such as starting to browse or select your privacy settings. These cookies do not store any personal information that can identify you and they are deleted as soon as you disable the website. 

These cookies usually remember the information that depends on the appearance of the website (representation on the website visitor’s device), language options, location determination, etc. We use a cookie that remembers your language selection. The basis for the processing of the data collected by these cookies is your consent.

We do not use these cookies.

This page uses Facebook, LinkedIn icon plugins.

You can choose the most acceptable way to refuse cookies:

1. When changing the cookie settings on the website:
   You can change your choice regarding the use of cookies at any time and withdraw your consent by clicking on this link.
2. changing settings in your browser:
   You can always change your browser settings on your computer, tablet or smartphone so that cookies are not accepted or are deleted if cookies are already saved. Detailed instructions depend on what browser you use and what device you use, more detailed information can be found here:
   
   • Chrome will surfyCLEAR on Android
   • Internet Explorer
   • ‘Microsoft Edge’
   • ‘Mozzila Firefox’
   • Google Chrome
   • “Opera”
   • Safari
   • ‘Apple’
   • on Android

Important! Please note that the rejection of all cookies can have a negative effect on the use of the website, for example, you will need to re-select the language each time you enter the website.

The information you provide us with social media means (including the use of the ‘Like’ and ‘Follow’ fields, and other communication) is controlled by the social network manager. 

Our website provides links to our social media accounts (hereinafter – Social accounts). We currently administer the following social accounts: 

• account https://www.facebook.com/kuranabiofuel on the social network Facebook;
• account https://www.linkedin.com/company/jsc-kurana/ on the social network LinkedIn.

We process the information contained in social accounts for the purpose of administration of accounts on the basis of your consent. We do not store the information on social accounts separately (when the data is processed for the purpose of administration of social accounts, but the data can be saved if it needs to be processed for another purpose, for example, for the purpose of defending rights).

When you visit social accounts, social network administrators enter cookies on your device that collect personal data. Cookies are saved both if you are a registered user of social networks and if you do not have an account on the relevant social network. We do not have access to your collected personal data and we can only receive statistical information about the traffic of social accounts from social network administrators.

We recommend that you read third-party privacy notices and contact service providers directly if you have any questions about how they use your personal data. 

The company does not carry out the transfer of personal data outside the European Union/European Economic Area.

We receive your data from you, your devices, our employees, service providers and contractors from our contracts.

We disclose information about you to the data processors we use (IT services, marketing service providers, group companies, services providing us, etc.).

In addition, we can disclose information about you: 

• if we have to do this according to the law or another legal act;
• for companies providing company audit and related services, legal and financial consulting service providers;
• for a company providing accounting services;
• when intending to sell a company, a part of the company’s activities or its assets, disclosing your personal data to a potential buyer of the activity or part of it;
• after selling the company’s activities or its essential part of assets to third parties. 

Except for the cases provided for in this Privacy Policy, we do not provide your personal data to any third parties. The list of recipients or the categories of recipients specified in the Privacy Policy may change, so if you wish to be informed about changes in your personal data, please notify us of this by e-mail specified in this Privacy Policy. by mail, indicating in the text of the letter ‘I would like to receive information about the change of recipients of my personal data, name and surname‘.

Your personal data will be processed in accordance with the requirements of the General Data Protection Regulation, the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts. When processing your personal data, we implement organizational and technical measures that ensure the protection of personal data against accidental or illegal destruction, alteration, disclosure, as well as against any other illegal processing.

If you believe that your rights as a data subject are and/or may be violated, please contact us immediately at the e-mail address specified in this Privacy Policy. by mail. We ensure that only after receiving your complaint will we contact you within a reasonable period of time and inform you about the progress of the complaint investigation, and then about the result.

If the results of the investigation do not satisfy you, you will be able to file a complaint with the supervisory authority – the State Data Protection Inspectorate: https://vdai.lrv.lt/ or in another state’s supervisory authority, in particular in the Member State where your permanent residence, place of work or place of alleged infringement is. 

You are responsible for the confidentiality of the data you provide, as well as that the data you provide to us is accurate, correct and complete. If the data you provide changes, you must immediately inform us about it by e-mail. by mail. In no case will we be responsible for the damage caused to you due to the fact that you provided incorrect or incomplete personal data or did not inform us if they have changed.

We can update or change this Privacy Policy at any time, if we consider it necessary when the personal data processing information changes (the scope of the personal data collected, new ones appear for the purposes of processing personal data, etc.) and in other cases when it is appropriate and necessary, in order to ensure the processing of personal data carried out by us We will also update transparency as well as the privacy policy when required by the supervisory authority. We will take measures to inform you about the most important changes in the privacy policy, about it on the website www.kurana.lt, but we recommend that you familiarize yourself with the Privacy Policy from time to time, as it may also contain minor changes. If you wish to receive an updated Privacy Policy, please notify us in the e-mail address specified in Section 2 of the Privacy Policy. to the postal address.

A previous version of the Privacy Policy can be found here.

Last Update on Privacy Policy: 2026 April 23