Privacy Policy

PRIVACY POLICY
Norwegian–Lithuanian Chamber of Commerce
Last updated: 24 September 2026

PRIVACY NOTICE
This Privacy Notice (the “Notice”) explains how and why the Norwegian–Lithuanian Chamber of Commerce (the “Chamber”, “we”, “us” or “our”) collects, uses, stores and otherwise processes personal data in connection with its website (www.nlcc.lt) and its activities, the purposes for which we process personal data, the legal grounds for such processing, the circumstances in which we may share personal data with third parties, and the rights available to individuals under applicable data protection legislation, including Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).
We are committed to protecting personal data and to processing it lawfully, fairly and transparently.

1. About the Norwegian–Lithuanian Chamber of Commerce
The Norwegian–Lithuanian Chamber of Commerce (registration code 302326713) is a non-profit, non-governmental business association that promotes and strengthens economic, commercial and professional relations between Norway and Lithuania.
The Chamber brings together companies, organisations and professionals interested in developing business relations, partnerships, investment and knowledge exchange between Norway and Lithuania.
For more information about the Chamber, please visit www.nlcc.lt

2. Contact Information
The Norwegian–Lithuanian Chamber of Commerce is the data controller for the personal data processed in connection with its activities, unless otherwise stated.
Norwegian–Lithuanian Chamber of Commerce
Address: K. Kalinausko g. 24, LT-03107 Vilnius, Lithuania
Email: info@nlcc.lt

Privacy Contact Person
If you have any questions about how the Chamber processes your personal data, or wish to exercise your rights under applicable data protection legislation, please contact our Privacy Contact Person:
Martyna Skisaker, Executive Director
Email: martyna.skisaker@nlcc.lt
Tel.: +370 610 02690

The Privacy Contact Person is a point of contact for privacy-related queries and requests. Having assessed the criteria under Article 37 GDPR, the Chamber has determined that it is not required to appoint a statutory Data Protection Officer; the Privacy Contact Person is not a Data Protection Officer within the meaning of Articles 37–39 GDPR.

3. Why Does the Chamber Collect Your Personal Data and on Which Grounds?
The Chamber processes personal data on the basis of one or more of the following legal grounds:
• Consent – you have given consent to the processing of your personal data for one or more specific purposes.
• Contract – processing is necessary to enter into or perform a contract with you or your organisation, including providing membership-related services.
• Legal obligation – processing is necessary for the Chamber to comply with a legal or regulatory obligation.
• Legitimate interests – processing is necessary for the legitimate interests pursued by the Chamber, provided that those interests are not overridden by your fundamental rights and freedoms.
Purpose Legal basis Legitimate interests pursued (where relevant)
Membership administration (including processing your online application) Contract N/A
Event invitations and general Chamber activities addressed to members and business contacts Legitimate interests Keeping members and relevant business contacts informed of Chamber activities reasonably connected to the existing relationship
Newsletter subscription (general public sign-up on the website) Consent N/A
Member-to-member introductions Legitimate interests Facilitating business connections among members, a core Chamber activity
Sponsorships and partnerships Contract N/A
Referrals (where you provide us with another person’s contact details) Legitimate interests Making an initial, proportionate approach to a person who may be interested in the Chamber; see Section 5
Legal / accounting records Legal obligation N/A
Stating a legitimate interest in this Notice does not by itself satisfy the Chamber’s internal accountability obligations. For each purpose based on Article 6(1)(f) GDPR, the Chamber maintains a separate internal Legitimate Interest Assessment; this Notice summarises the outcome for transparency purposes only.

4. What Personal Data Does the Chamber Collect?
Depending on your relationship with the Chamber and how you interact with us (including our website), we may collect the following categories of personal data:
• Identification and contact information: first and last name, job title/position, company or organisation, email address, telephone number, postal or business address, other professional contact details.
• Professional information: employer or organisation, professional position, industry and areas of expertise, business interests, professional biography, where voluntarily provided.
• Membership information: membership category and package selected, membership status, membership history, information about your relationship with a Chamber member organisation, billing information necessary to administer membership fees.
• Member directory information: for individuals named as a member organisation’s contact person, the information described in Section 15 (Member Directory).
• Event and participation information: events registered for or attended, invitations sent, guest lists, photographs or audiovisual recordings taken at Chamber events, where applicable.
• Account information: if you are provided with login credentials to the members’ area of our website, your username and authentication data.
• Communication and preference information: correspondence with the Chamber, newsletter subscription (email address), communication preferences, records of consent or its withdrawal.
We do not generally seek to collect special categories of personal data (Article 9 GDPR) through our website. On a limited, voluntary basis, you may choose to share dietary or accessibility information in connection with a specific event, which may in some cases reveal health-related information; this is addressed in Section 16.

5. How Does the Chamber Collect Personal Data?
The Chamber may obtain personal data directly from you, for example when you:
• apply for or renew Chamber membership using our online application form at nlcc.lt/membership/join/;
• register for an event or activity;
• attend a Chamber event;
• contact us by email, telephone, post or other communication channels;
• provide us with your business card or professional contact details;
• subscribe to our newsletter via our website;
• participate in surveys or other Chamber initiatives;
• request information, services or introductions; or
• otherwise communicate or interact with the Chamber, including through our website.
Membership Application Form
When you complete and submit the online membership application form at nlcc.lt/membership/join/, you provide the Chamber with personal data necessary to process your application for NLCC membership, in accordance with Sections 3 and 4 above. A link to this Privacy Policy is provided on the form.
Information You Provide About Other People
If you provide us with the contact details of another individual — for example, referring a colleague or business contact who may be interested in the Chamber — please do so only where there is a genuine, proportionate reason for the introduction, and limit the information you give us to what is necessary (typically, name, organisation and a business contact detail). That person is not automatically added to our newsletter or other marketing communications as a result. In accordance with Article 14 GDPR, and subject to any exception available under that Article, we will inform the person of our identity, the purpose of processing, the source of their data and their rights, generally before or at the time we first contact them. We process such data on the basis of our legitimate interest in making a proportionate, one-off approach (Section 3), retain it only for the short period necessary for the introduction and any immediate follow-up as described in Section 6, and handle referrals of this kind through an internal process.
Information We Receive From Others
We may also receive personal data from your employer or organisation where it is a Chamber member, sponsor, partner or event participant and has provided your details as a contact person, from event co-organisers and sponsors, from service providers assisting with event registration, and from publicly available professional or business sources. Where an event is co-hosted with another organisation and registration takes place on that organisation’s own website or platform, that organisation processes your data under its own privacy notice; please see Section 7 for further information.

6. How Long Does the Chamber Keep Personal Data?
The Chamber retains personal data only for as long as necessary for the purpose for which it was collected, applying the following criteria:
• The membership agreement itself and directly related fee/billing records: for the duration of the membership, and, where necessary to establish, exercise or defend contractual claims, for a further period reflecting the applicable statutory limitation periods under Lithuanian law, which may be up to 10 years (Article 1.125(1) of the Civil Code). This period applies specifically to the membership agreement and directly related financial records — not to every piece of personal data the Chamber may hold in connection with a former member, which is instead retained under the categories below.
• Accounting and financial records: retained for 10 years, as required by Lithuanian accounting legislation.
• General business contact information (not tied to an active membership or contract): retained for as long as the contact remains relevant to an active relationship with the Chamber, reviewed periodically, and deleted or anonymised when it is no longer relevant or on request.
• Event registration and attendance records: typically retained for up to 1 year after the event for administrative purposes.
• Newsletter subscription data: retained until you unsubscribe or withdraw consent.
• General correspondence and enquiries: retained for as long as necessary to handle the matter, and typically deleted within 12 months of the last relevant interaction, unless a longer period is needed to establish, exercise or defend legal claims.
• Referral / third-party contact data (Section 5): retained only for the short period needed to make and follow up on an initial approach, and deleted promptly if the person does not engage further or objects.
• Member directory information: retained for as long as the underlying membership is active, and removed within a reasonable period after the membership ends (see Section 15).
• Photographs and audiovisual recordings: retained for as long as they continue to serve a genuine documentation or promotional purpose, subject to removal on request (see Section 16).
When personal data are no longer required, the Chamber securely deletes or anonymises them.

7. Who Does the Chamber Share Personal Data With?
Where necessary and lawful, the Chamber may share personal data with event co-hosts, partners, members, sponsors, service providers and professional advisers involved in supporting the Chamber’s activities.
The Chamber uses the following third-party service providers, which process personal data on the Chamber’s behalf as processors:
• Microsoft 365 – for business email, calendars, document management, communication and file storage;
• SuperOffice AS – as the Chamber’s CRM and contact management system for managing members, business contacts, partners, sponsors, event participants and communications, including hosting the online forms used to register for some Chamber events;
• Interneto vizija, UAB – for hosting the Chamber’s website, www.nlcc.lt;
• our appointed IT service provider – for the technical administration of the Chamber’s IT systems;
• our appointed accounting service provider – for bookkeeping and accounting purposes (e.g., membership fee invoicing).
Co-Hosted Events
Some Chamber events are organised jointly with other organisations (for example, other bilateral chambers of commerce, law firms or business partners). For such events, registration may take place on the co-organiser’s own website, using its own registration or analytics tools. In that case, the co-organiser processes your data as an independent controller under its own privacy notice, and we encourage you to review it. The Chamber’s role in relation to that registration data (for example, whether we separately receive an attendee list) depends on the specific arrangement with the co-organiser for that event.
Where service providers process personal data on the Chamber’s behalf, we require them to do so only for authorised purposes and in accordance with applicable data protection requirements, under a written agreement that reflects the requirements of Article 28 GDPR. The Chamber does not sell personal data to third parties.

8. Cookies and Similar Technologies
The Chamber’s website provides a members’ area that requires a username and password issued by the Chamber (Section 4). Accessing that area necessarily involves a session/authentication cookie or similar technology to keep you signed in; this is strictly necessary for that feature to work and does not require your consent.
Beyond this, the Chamber has not yet completed a full technical review of every cookie, script or third-party technology that may be present on its website (for example, in connection with analytics, advertising, embedded content or anti-spam tools). Verification required before publication: the Chamber will complete this review before the Notice is published and will update this Section to accurately describe any further cookies or similar technologies identified, together with their purpose, provider and retention period, and will implement an appropriate consent mechanism for any that are not strictly necessary, as required by law. A current, complete list of cookies used on the website is available on request from the Chamber using the details in Section 2.

9. International Transfers of Personal Data
Most of the Chamber’s service providers are established within the European Union or the European Economic Area (EEA), including in Lithuania and Norway. Personal data transferred to a provider established in Norway (an EEA state) is not considered a transfer to a third country under the GDPR and does not require additional safeguards.
Where personal data is transferred to global providers located outside the EEA (such as the United States) — for example, Microsoft — the Chamber ensures that an appropriate transfer mechanism is in place, such as the European Commission’s Standard Contractual Clauses (SCCs) and/or, where applicable, the EU-U.S. Data Privacy Framework (DPF) adequacy decision. Because the legal status of the DPF is subject to ongoing legal challenge, the Chamber monitors developments and is prepared to rely on SCCs as an alternative safeguard if required.
Registration or other data processing carried out by a co-organiser on its own platform for a co-hosted event (Section 7) is governed by that organisation’s own arrangements and is not covered by this Section.
Information about the specific safeguards applied to a particular transfer may be obtained by contacting the Chamber using the details in Section 2.

10. How Can You Access and Control Your Personal Data?
Subject to the conditions and limitations under the GDPR, you may have the following rights:
• Right of access – to request confirmation as to whether we process your personal data and, where applicable, a copy of it.
• Right to rectification – to request correction or completion of inaccurate or incomplete personal data.
• Right to erasure – to request deletion of your personal data where the conditions under the GDPR are met.
• Right to restriction of processing – to request that we restrict processing in certain circumstances.
• Right to data portability – where the processing is carried out by automated means and is based on your consent or on a contract with you, to receive the personal data you provided to us in a structured, commonly used, machine-readable format, or to have it transferred to another controller where technically feasible.
• Right to object – to object, on grounds relating to your particular situation, to processing based on our legitimate interests; the Chamber will stop such processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. You have an absolute right to object to direct marketing (see Section 11).
• Right to withdraw consent – where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint – to file a complaint with a competent data protection supervisory authority (see Section 18).
You may exercise these rights by contacting us using the details in Section 2.

11. Newsletter and Direct Marketing
The Chamber distinguishes between the following types of communication:
• Membership administration communications (for example, invoices, renewal notices, changes to membership terms) are sent as part of performing the membership contract and are not marketing.
• Chamber activity updates sent to members and other existing business contacts (for example, event invitations relevant to the Chamber’s activities) are sent on the basis of the Chamber’s legitimate interest in keeping its community informed, and always include a simple way to opt out.
• The general newsletter, which anyone can subscribe to via the sign-up field on our website, is sent only to those who have actively subscribed, on the basis of consent, and can be cancelled at any time using the unsubscribe link included in every newsletter.
• Marketing of third-party offers or sponsor content, where this occurs, is treated as direct marketing and requires your prior, separate opt-in consent; it is not bundled with membership administration or general Chamber updates.
You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you no longer wish to receive newsletters, invitations or other marketing communications, you may use the unsubscribe link in the relevant communication or contact the Chamber directly. Objecting to direct marketing does not affect other processing carried out on a different lawful basis, such as membership administration.

12. How to Request a Copy of Your Personal Data
To access or receive a copy of the personal data the Chamber holds about you, please contact us using the details in Section 2. We may need to verify your identity before processing your request. If we refuse a request, we will explain why, subject to any restrictions under applicable law.

13. How to Withdraw Your Consent
Where the Chamber processes your personal data on the basis of consent, you may withdraw it at any time by contacting us or using the relevant unsubscribe or preference-management option. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, but may mean we are unable to continue providing certain services or communications that depend on that consent.

14. What Happens If You Choose Not to Provide Personal Data?
In some cases, the Chamber needs certain personal data to enter into or perform a membership or other contract, register you for an event, provide a service, comply with legal obligations, or administer our relationship with you or your organisation. If you do not provide the necessary personal data, we may be unable to provide the relevant service, register you for an event, maintain your membership, or otherwise fulfil the relevant purpose. Where provision of personal data is optional, we will indicate this when collecting the information.

15. Member Directory
The Chamber publishes a directory of its members on its website (including on the homepage and at nlcc.lt/membership/member/), which is publicly accessible without the need to log in.
For each member organisation, the directory may include the company name, logo, a short description, and, in some cases, the name, job title and direct business contact details (such as phone number or email address) of one or more individual representatives, as provided by the member organisation.
NLCC is the controller for the publication of this information and relies on its own legitimate interest (Article 6(1)(f) GDPR) in enabling members to be found and contacted by other members and by the wider business community, which the Chamber considers a core part of promoting its members. The Chamber has weighed this interest against the impact on the individuals concerned, taking into account that the information published is limited to business contact details relevant to a person’s professional role, that individuals can object to publication at any time (see below), and that entries are removed once no longer relevant (see Section 6).
A member organisation that submits or authorises an individual’s details for the directory is responsible for the accuracy of that information and for ensuring it has an appropriate basis for providing it to the Chamber (for example, because the individual acts as the organisation’s designated external contact). This is separate from, and does not limit, NLCC’s own responsibility as controller for its decision to publish and continue publishing that information.
An individual whose details are published in the directory has an independent right, at any time, to object to that publication under Article 21 GDPR — this right belongs to the individual personally, and the Chamber will act on such a request regardless of the member organisation’s wishes. To object, to update the details shown, or to request that an entry be limited to company-level information only, please contact the Chamber using the details in Section 2, or your organisation’s designated NLCC contact. Directory entries are removed within a reasonable period after the relevant membership ends.

16. Photographs and Audiovisual Recordings at Events
The Chamber may take general photographs and video recordings at its events to document and promote Chamber activities (for example, wide or group shots of attendees). This is done on the basis of the Chamber’s legitimate interest in documenting and promoting its activities, and, where reasonably practicable, the Chamber will give prior notice that photography or recording is taking place (for example, at registration or via visible signage at the venue).
Where the Chamber intends to feature an identifiable individual prominently — for example, in a portrait-style photograph used in marketing materials, the website or social media — the Chamber will, where reasonably practicable, give the individual a prior opportunity to decline before such use.

Your right to object: If you do not wish to be photographed or recorded, please inform the Chamber via email prior to the event, or notify the event staff/photographer upon arrival. If your easily identifiable image has already been published and you wish for it to be removed, please contact the Chamber using the details in Section 2, and we will promptly take it down.
If you choose to share dietary or accessibility information in connection with an event, you do so at your own initiative to help us make appropriate arrangements for you. Where this information reveals data concerning health or another special category of data within the meaning of Article 9 GDPR, the Chamber processes it on the basis of your explicit consent (Article 9(2)(a) GDPR). Simply typing such information into a free-text field is not, by itself, sufficient to constitute explicit consent; the event registration process must include a clear, specific and unambiguous means of giving that consent (for example, a dedicated consent statement or checkbox), separate from providing the information itself, and must allow consent to be withdrawn. Event registration is currently carried out through a Chamber-configured online form. Verification required before publication: the Chamber should confirm that this form includes such a consent mechanism wherever dietary or accessibility information is requested, and amend it if it does not. Such information is in any event used only for the relevant event, is not used for any other purpose, and is not retained beyond what is necessary for that purpose.

17. Automated Decision-Making and Profiling
The Chamber does not use personal data for automated decision-making that produces legal or similarly significant effects on individuals. If this changes, we will provide the information required under applicable data protection legislation.

18. How to Register a Complaint
You have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), the competent supervisory authority in Lithuania:
Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
Email: ada@vdai.lrv.lt
Website: www.vdai.lrv.lt

19. Security of Personal Data
The Chamber takes appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or unlawful processing. Access to personal data is limited to persons who need it for legitimate business or organisational purposes. However, no method of transmission or storage can be guaranteed to be completely secure.

20. Changes to This Notice
The Chamber may update this Notice from time to time to reflect changes in its activities, services, technology, applicable legislation or data protection practices. Material changes will be published on the Chamber’s website or communicated through other appropriate channels, where required.

Last updated: 24 September 2026