Privacy Policy

This Privacy Policy (hereinafter referred to as the Policy) sets forth how UAB “Profitus Crowdfunding” (hereinafter referred to as Profitus) processes the personal data of website visitors, registered users, investors, project owners, their representatives, beneficiaries, collateral providers, guarantors, participants in events or contests, and other individuals who contact us.

Additional information regarding the processing of personal data may be provided in other Profitus documents related to specific Profitus services or products (such as informational notices, contracts, etc.).

1. General Information

1.1. The controller of your personal data is UAB “Profitus Crowdfunding”, company code 304570552, registered office at Lvivo g. 101, Vilnius, phone number +370 637 60776, email support@profitus.lt.

1.2. Profitus has appointed a Data Protection Officer. You can contact him or her by email at dpo@profitus.lt.

1.3. This Policy applies whenever you use the Profitus website, a crowdfunding services platform located at www.profitus.com (hereinafter referred to as the “Platform”), participate in Profitus events or contests, or otherwise provide your personal data.

1.4. If the Platform user is a legal entity, this Policy also applies to natural persons whose data is transferred to Profitus as a result of such legal entity’s use of the Platform or Profitus’s services, including managers, representatives, beneficiaries, collateral providers, guarantors, and other related persons. In such a case, the legal entity must properly inform these individuals about the transfer of their data to Profitus.

1.5. When processing your personal data, Profitus adheres to:

1.5.1. Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the GDPR);

1.5.2. The Law on the Legal Protection of Personal Data of the Republic of Lithuania;

1.5.3. The Law on Electronic Communications of the Republic of Lithuania;

1.5.4. other laws and regulations governing the protection of personal data;

1.5.5. the instructions/recommendations of supervisory authorities and other competent authorities.

1.6. Individuals under the age of 14 may not provide personal data through the Profitus website or the Platform without the consent of their parents or other legal guardians.

1.7. Profitus reserves the right to update this Policy from time to time, so we encourage you to review it periodically. The updated version is posted on the Profitus website, and we may also notify you of significant changes when appropriate.

2. Principles of Personal Data Processing

2.1. Profitus processes personal data in accordance with the following principles:

2.1.1. Your personal data is collected and processed for clearly defined and legitimate purposes established prior to the processing of your personal data, and is not further processed in a manner incompatible with those purposes (the principle of purpose limitation);

2.1.2. Your personal data is processed fairly, lawfully, and transparently, with your consent or on another lawful basis for processing personal data (the principle of lawfulness, fairness, and transparency);

2.1.3. Your personal data is adequate, relevant, and limited to what is necessary for the purposes for which it is processed (the principle of data minimization);

2.1.4. Your personal data is accurate and, where necessary for the purposes of processing, kept up to date. Inaccurate or incomplete personal data is corrected, supplemented, destroyed, or its processing is suspended; all reasonable measures are taken to ensure that personal data that is not accurate, taking into account the purposes of its processing, is deleted or corrected without delay (principle of accuracy);

2.1.5. Your personal data is stored in a form that allows your identity to be determined for no longer than is necessary to achieve the purposes for which the personal data was collected and is being processed (the principle of storage limitation);

2.1.6. Your personal data is processed in such a way that appropriate technical or organizational measures are implemented to ensure the security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage (principle of integrity and confidentiality).

3. Purposes, legal bases, and categories of personal data processing

3.1. Profitus processes personal data in the categories listed below:

3.1.1. Personal identification data, such as first name, last name, personal identification number, date of birth, citizenship, and details of an identity document;

3.1.2. Contact information, such as address, ZIP code, phone number, and email address;

3.1.3. Data related to education and professional activities, such as educational background, employer, length of service at the current employer, type of employment contract, current duties, and business and commercial activities;

3.1.4. Information about the family, the number of minor children, and information about heirs;

3.1.5. Social media account information, such as first name, last name/account name, profile picture, and other information publicly available on your social media account (e.g., Facebook);

3.1.6. Financial data, such as income and its sources, information about your bank accounts at other financial institutions and your assets, information about transactions you have entered into, expenses, outstanding loans, and other financial obligations;

3.1.7. Information regarding creditworthiness and credit history, such as credit history and credit rating;

3.1.8. Data related to the services provided by Profitus, such as information about the services Profitus provides to you and related data (e.g., account number), data regarding the performance or non-performance of contracts, concluded transactions, valid and expired contracts, and submitted applications;

3.1.9. Data necessary to ensure compliance with anti-money laundering, counter-terrorist financing, and anti-fraud requirements, as well as the enforcement of international sanctions, such as data regarding whether you, your close family members, and close associates are politically exposed persons, data on beneficial owners, data on business activities and transaction parties, data on the monitoring of business relationships, data from documents supporting a financial transaction or transaction, and other data necessary to implement the “Know Your Customer” principle and to monitor business relationships and transactions;

3.1.10.Data necessary to ensure compliance with tax administration requirements, such as country of residence for tax purposes, taxpayer identification number, date and place of birth;

3.1.11.Information about you as the manager, representative, or beneficial owner of a legal entity that uses or has expressed an intention to use the services provided by Profitus;

3.1.12.Information about you as the manager/representative or employee of a Profitus business partner, such as your first name, last name, job title, phone number, and email address;

3.1.13. Data regarding telephone calls made to the Profitus contact center’s phone number, such as the caller’s subscriber number and call metadata (date, time, and duration of the call);

3.1.14. Data obtained from government agencies, such as data obtained in response to inquiries from courts, law enforcement agencies, notaries, bailiffs, attorneys, and tax authorities regarding income, financial obligations, assets held, and outstanding debts;

3.1.15. Data provided or generated through electronic means of communication, such as data submitted via email, on a website, or on social media, as well as traffic data—the IP address used by the internet user during the connection, operating system version and parameters of the device you use to access the content/services; login information—the time and duration of your session; and any information stored in cookies we have set on your device;

3.1.16. Biometric data – an image of your face, which is processed only if you intend to become a Profitus customer remotely;

3.1.17. The information you provide when submitting a report to Profitus regarding a violation under the Law on the Protection of Whistleblowers of the Republic of Lithuania or a report regarding a violation of laws and regulations governing business activities.

4. For what purposes do we collect and use your personal data?

4.1. Profitus processes your personal data for the purposes listed below:

4.1.1. Identification and verification of a person’s identity; implementation of the “Know Your Customer” principle;

4.1.2. Determination and assessment of creditworthiness;

4.1.3. loan risk assessment and management, including, but not limited to, compliance with the maximum loan-to-value ratio for a single customer and a group of related customers;

4.1.4. the provision of financial services;

4.1.5. Entering into contracts and fulfilling contractual obligations;

4.1.6. maintaining our relationship with you and communicating with you;

4.1.7. providing consultations, responding to your requests, complaints, and inquiries, and assessing your needs;

4.1.8. Ensuring compliance with anti-money laundering, counter-terrorist financing, and anti-fraud requirements, as well as the enforcement of international sanctions;

4.1.9. Ensuring compliance with tax administration requirements;

4.1.10. Organizing and conducting the selection of employees and interns;

4.1.11. Protection and safeguarding of Profitus’ rights and legitimate interests;

4.1.12. Compiling and maintaining a list of Profitus employees and persons closely associated with them, as well as administering notifications regarding transactions concluded (executed) for your benefit involving Profitus financial instruments, and publicly disclosing such transactions in accordance with the procedures established by law;

4.1.13. Investigation (conducting an inquiry) into a possible violation under the Law on the Protection of Whistleblowers of the Republic of Lithuania or a violation of laws and regulations governing Profitus’s activities;

4.1.14. Direct marketing*;

4.1.15. Organizing and conducting contests and/or promotions for customers;

4.1.16. Debt management and collection.

4.2.*Please be advised that you have the right to opt out of receiving direct marketing messages sent by Profitus at any time by notifying Profitus of your decision, by email after receiving a direct marketing message—by clicking the active opt-out link, thereby opting out of the relevant types of messages. You can also opt out of receiving all direct marketing messages from Profitus on the Platform in your account, under the “Message Settings” section.

5. The legal basis on which we process your personal data.

5.1. Profitus processes your personal data on the legal grounds specified in the GDPR:

5.1.1. when there is a legal obligation to do so, i.e., when applicable laws require Profitus to process your personal data;

5.1.2. to enter into and perform the contract concluded with you;

5.1.3. to pursue Profitus’s legitimate interests, where your personal interests do not take precedence (for example, providing Profitus’s services, ensuring the selection of employees and interns, assessing credit risk, managing your debts, resolving disputes, etc.);

5.1.4. Based on your consent to the processing of your personal data;

5.1.5. in the public interest.

6. Automated decision-making and profiling

6.1. Profitus may process personal data using automated means, as well as employ profiling and, in certain cases, automated decision-making, when necessary for identity verification, verifying data in international or other databases, monitoring operations and transactions, complying with legal requirements regarding the prevention of money laundering and terrorist financing, or providing personalized offers for direct marketing purposes.

6.2. Profitus implements appropriate measures to protect your rights, freedoms, and legitimate interests, including the option, where applicable under the law, to request human intervention.

7. Sources from which we obtain your personal data

7.1. Profitus processes your personal data, which:

7.1.1. obtained directly from you (when you fill out and submit questionnaires, inquiries, requests, complaints, or applications—whether in person at the Profitus headquarters, on the Platform, via the Profitus mobile app, or on the website www.profitus.lt), on Profitus social media accounts when you submit an inquiry, comment, or participate in Profitus contests/games organized there, or when you call the Profitus contact center phone number);

7.1.2. obtained from other sources;

7.1.3. are generated automatically, to the extent provided for by applicable laws (when visiting a website and/or social media account, or using apps).

7.2. We would like to draw your attention to the fact that if you provide us with the personal data of other individuals associated with you (such as family members, company employees, shareholders, guarantors, etc.), you are required to inform these individuals about the processing of their personal data by Profitus and undertake to familiarize them with this Policy.

7.3. Profitus obtains your personal data from other sources, such as:

7.3.1. financial institutions;

7.3.2. government agencies and institutions (such as the Bank of Lithuania, the Ministry of Finance of the Republic of Lithuania, the State Social Insurance Fund Board under the Ministry of Social Security and Labor (SODRA), and the State Data Agency);

7.3.3. The State Enterprise Center of Registers (e.g., the Population Register, the Information System of Participants in Legal Entities (JADIS), the Beneficiaries of Legal Entities Subsystem (JANGIS), the Register of Legal Entities, etc.) and other registers;

7.3.4. courts and law enforcement agencies;

7.3.5. other persons performing the functions assigned to them by law (for example, notaries, attorneys, bailiffs, insolvency administrators);

7.3.6. service providers that manage joint debtor databases (for example, UAB “Creditinfo Lietuva”);

7.3.7. insurance companies, insurance brokerage firms;

7.3.8. credit intermediaries;

7.3.9. other individuals (or their representatives) when they provide information regarding close relatives, in-laws, co-debtors, guarantors, providers of security, and the like;

7.3.10. other individuals (or their representatives) when they provide information about close family members or close associates who hold or have held (within the past year) important public offices;

7.3.11. legal entities, if you are the head/representative, employee, authorized representative, beneficial owner, etc., of a legal entity;

7.3.12. documents submitted to and intended for Profitus in connection with the performance of the contract or compliance with legal requirements, which may contain personal data (e.g., property appraisal reports, registry extracts, etc.);

7.3.13. third parties and/or publicly available sources, to the extent permitted by applicable law (for example, the social network LinkedIn).

7.3.14. We obtain this information by monitoring the use of our systems and services.

7.4. Please be advised that by providing us with your personal data, you assume responsibility for the accuracy, completeness, and currency of such data. In the event that inaccurate, incorrect, incomplete, or misleading personal data is provided to us, we reserve the right to refuse to process such data, delete it, restrict its processing, and/or restrict access to the relevant services. If you provide us with the personal data of other individuals (for example, your family members, employees, or other related persons), you are also responsible for the accuracy, completeness, and timeliness of such data and confirm that you have a lawful basis for providing such data, including, where applicable, the consent of the relevant individual. If necessary, we reserve the right to request that you confirm your right to provide such data. In cases where an individual contacts us to request information regarding their personal data, we reserve the right to identify you as the source of such data.

8. Transfer of Personal Data

8.1. Profitus may transfer your personal data to the entities listed below:

8.1.1. government agencies and institutions, as well as other entities performing the functions assigned to them by law (such as supervisory authorities, law enforcement agencies, tax authorities, bailiffs, notaries, and attorneys);

8.1.2. banks and financial institutions;

8.1.3. insurance companies and insurance brokerage firms;

8.1.4. auditors, legal and financial consultants;

8.1.5. to state registries (for example, the State Enterprise Center of Registers);

8.1.6. Profitus shareholders and their authorized representatives (such as legal and financial advisors);

8.1.7. Profitus assignees of rights and obligations;

8.1.8. persons who have provided security for the performance of obligations (such as guarantors, collateral providers, or sureties);

8.1.9. courts, alternative dispute resolution bodies, and insolvency administrators;

8.1.10. debt collection agencies to which debt claims are assigned;

8.1.11. service providers that manage joint debtor databases (for example, UAB “Creditinfo Lietuva”);

8.1.12. participants in national, European Union, and international payment systems, and other relevant parties;

8.1.13. other parties that provide services to Profitus or are involved in the services provided by Profitus (for example, information technology service providers, postal service providers, archiving service providers, credit intermediaries, etc.).

8.1.14. Profitus ensures that it transfers your personal data only in accordance with the requirements of applicable laws. Service providers (data processors) engaged by Profitus process your personal data only for strictly defined purposes, which are set forth in personal data processing agreements.

8.2. When using data processors or partners, Profitus ensures that personal data is disclosed to them only to the extent necessary to provide services or achieve legitimate purposes.

8.3. If, in certain cases, personal data needs to be transferred outside the European Economic Area, Profitus will implement the safeguards provided for by law to ensure an adequate level of data protection.

9. Retention periods for personal data

9.1. Profitus retains personal data only for as long as necessary to achieve the specific purpose and as required by applicable laws.

9.2. The main retention periods for personal data are:

9.2.1. data processed for the purposes of providing crowdfunding services, identity verification, the prevention of fraud, money laundering and terrorist financing prevention, prevention of other financial crimes, fulfillment of other legal obligations, and creditworthiness assessment, shall be retained for 10 years from the date of the financing transaction or for 8 years from the end of the business relationship, whichever is later; this period may be extended by an additional 2 years if required by a competent authority;

9.2.2. Correspondence related to business relationships is retained for 5 years from the end of the business relationship, with a possible extension for an additional 2 years;

9.2.3. Records related to the handling of disputes and complaints are retained for 3 years from the date the final response is provided;

9.2.4. Debt management data is retained for 10 years from the date the debt is settled; if legal proceedings are ongoing, this period may be extended to 24 months from the date the debt is recovered;

9.2.5. Direct marketing data is retained for 1 year after the end of the business relationship, unless you withdraw your consent or object earlier;

9.2.6. Statistical data may be processed during Profitus’s period of operation provided that such data is anonymized or used for legitimate statistical analysis;

9.2.7. Event data is retained for 1 year after the event ends;

9.2.8. Contest data is retained for up to 2 years after the contest ends, and in the event of a prize being awarded, for up to 10 years from the date the prize is awarded.

9.3. Personal data may be retained for a longer period if necessary to assert, exercise, or defend legal claims, to conduct an investigation, or to comply with legal requirements.

10. Cookies

10.1. Profitus uses cookies on its website to ensure the proper functioning of the website and its online services, to remember user preferences, to analyze website traffic and usage, to evaluate the effectiveness of advertising, and to tailor marketing content.

10.2. The following cookies are used on the Platform’s website:

10.3. Some cookies are necessary for the website to function properly, while others are used for analytics and marketing purposes. The use of cookies may be based on your consent, with the exception of essential cookies.

10.4. You can configure your browser to accept all cookies, reject them, or notify you when a cookie is sent. If you disable or delete cookies, some website features may not work properly, your browsing experience may be slowed down, or your access to certain features may be restricted.

11. Security of Personal Data

11.1. Profitus implements technical, organizational, and physical security measures designed to protect personal data from loss, destruction, unauthorized disclosure, alteration, or other unlawful processing.

11.2. Although Profitus takes reasonable security measures, no website, data transmission over the Internet, computer system, or wireless connection is completely secure, and therefore absolute security cannot be guaranteed.

12. Partner Services and Third-Party Websites

12.1. The Platform may contain links to third-party websites or services, and may also offer services from partners.

12.2. Third-party websites and services are subject to their own privacy policies; therefore, you should review their data processing terms before using such websites or services.

12.3. If a partner’s service is provided at your request, certain information about you may be shared with the relevant service provider to the extent necessary to provide that specific service.

12.4. Profitus is not responsible for the content or privacy practices of third-party websites, services, or advertising solutions that it does not control.

13. Your rights

13.1. As a data subject whose personal data is processed by Profitus, you have the following rights:

13.1.1. the right to know (be informed) about the processing of your data (the right to know);

13.1.2. the right to access your data and learn how it is processed (right of access);

13.1.3. the right to request the rectification or, taking into account the purposes of the processing of personal data, the completion of any incomplete personal data concerning you (the right to rectification);

13.1.4. to object to the processing of your personal data if such processing is based on your consent;

13.1.5. request that the processing of your personal data be restricted on one of the lawful grounds (right to restriction);

13.1.6. the right to withdraw your consent to the processing of your personal data. Such withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent;

13.1.7. the right to request the erasure or destruction of your personal data (the right to be forgotten) when such personal data is processed on the basis of your consent. This right does not apply to cases where you request the erasure of your personal data that Profitus processes on another legal basis, for example, where the processing of personal data is necessary for the conclusion or performance of a contract or where a legal obligation applies;

13.1.8. the right to object to a decision made entirely by automated means if such a decision has legal consequences or a similarly significant effect;

13.1.9. the right to data portability;

13.1.10. the right to lodge a complaint with the State Data Protection Inspectorate if you believe that your personal data is being processed in a manner that infringes upon your rights and legitimate interests regarding personal data protection. For more information, please visit www.vdai.lrv.lt.

13.2. To exercise your rights, please contact us by email at dpo@profitus.lt or support@profitus.lt. When submitting your request, please include your first and last name, contact information, and a detailed description of your request.

13.3. Before contacting the State Data Protection Inspectorate, we encourage you to contact Profitus first so that we can promptly assess the situation and, if possible, resolve it.

14. Final Provisions

14.1. Profitus reserves the right to unilaterally amend this Policy by notifying you via an announcement on the Profitus website at www.profitus.com, by email, or through a notification on the Platform.

14.2. This Policy is published on the Profitus website at www.profitus.com.

14.3. This Privacy Policy is reviewed and updated in light of changes in legislation and/or Profitus’ operations, but at least once every 2 (two) years. Upon updating the Policy, we will notify you by posting a notice on the Profitus website at www.profitus.com and/or through other means.