1. General Provisions and Data Controller
1.1. This Privacy Policy (hereinafter – the Policy) explains how UAB "FINEGRI" (hereinafter – the Company, we, or Data Controller) collects, uses, stores, and protects the personal data of visitors to the website https://finegri.com (hereinafter – the Website), business partners, customers, suppliers, persons submitting enquiries or sample requests, and job applicants.
1.2. Data Controller details:
UAB "FINEGRI"
Legal entity code: 305782615 (data collected and stored in the Register of Legal Entities of the Republic of Lithuania)
Registered office address: Pramonės g. 26A, LT-94103 Klaipėda, Republic of Lithuania
Phone: +370 672 63783
Email: office@finegri.com
Website: https://finegri.com
1.3. The Company is not required to appoint a Data Protection Officer under Article 37(1) of the General Data Protection Regulation (GDPR). For all questions relating to the processing of personal data and the exercise of your rights, please contact the Company by email at office@finegri.com or by post to Pramonės g. 26A, LT-94103 Klaipėda, Republic of Lithuania.
1.4. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania, and other applicable legal acts.
2. Definitions
2.1. Personal data means any information relating to an identified or identifiable natural person (data subject).
2.2. Data subject means a natural person whose personal data are processed by the Company (e.g. a Website visitor, representative of a customer, supplier or partner, person submitting an enquiry, or job candidate).
2.3. Processing means any operation or set of operations performed on personal data, such as collection, recording, storage, consultation, use, disclosure, or erasure.
2.4. Other terms used in this Policy have the meanings defined in Article 4 of the GDPR.
3. Principles of Personal Data Processing
When processing personal data, the Company adheres to the principles set out in Article 5 of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
4. Purposes, Categories of Personal Data, Legal Bases, and Retention Periods
4.1. The Company processes personal data strictly for the following defined purposes:
| Purpose of Processing | Categories of Personal Data | Legal Basis (GDPR) | Retention Period |
|---|---|---|---|
| 4.1.1. Handling business enquiries, commercial offers, and general requests ("Contact Sales", "General Enquiries", email/phone enquiries) | First name, last name, company, job title, country, email address, phone number, market/industry, content of the enquiry and subsequent correspondence. | Art. 6(1)(b) GDPR (steps prior to entering into a contract) and/or Art. 6(1)(f) GDPR (legitimate interest to respond to business enquiries and maintain B2B communication). | 1 year from the date the enquiry is resolved or the end of communication (if no contract is concluded). |
| 4.1.2. Product sample ordering and delivery ("Request a Sample") | First name, last name, company, job title, delivery address (postal address, postal code, city, country), email address, phone number, market/industry. | Art. 6(1)(b) GDPR (performance of sample delivery arrangement) and Art. 6(1)(f) GDPR (legitimate interest to fulfil B2B sample requests). | 1 year from sample dispatch (or in accordance with statutory accounting retention periods where dispatch/accounting documents are issued). |
| 4.1.3. Conclusion and performance of B2B contracts with customers, suppliers, and partners, and accounting | Representative's first name, last name, job title, business email, phone number, power of representation, contract details, delivery and invoicing records. | Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (statutory tax and accounting obligations), and Art. 6(1)(f) GDPR (legitimate interest to administer B2B agreements and defend legal claims). | 10 years after expiry or termination of the contract / completion of the operation, in accordance with Lithuanian archiving and accounting regulations. |
| 4.1.4. Administration of registered user accounts (access to restricted technical/quality documentation) | First name, last name, profile, market, company, job title, country, email address, phone number, encrypted password, account activity metadata. | Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest to provide controlled B2B access to technical documentation). | For the duration of the active account and up to 12 months after the last login or until the user requests account deletion. |
| 4.1.5. Recruitment and candidate selection ("Careers") | First name, last name, contact details, CV, education, qualifications, professional experience, motivation letter, interview assessment notes. | Art. 6(1)(b) GDPR (steps at the request of the candidate prior to entering into an employment contract) and/or Art. 6(1)(a) GDPR (consent, where applicable). | Until the end of the specific recruitment selection. Candidate data are not stored after the recruitment process ends unless separate consent is obtained. |
| 4.1.6. Ensuring Website technical operation, information security, and incident prevention | Technical server log data: IP address, date and time of request, requested URL, HTTP status code, browser type and operating system. | Art. 6(1)(f) GDPR (legitimate interest to ensure the security, stability, and availability of the Website and IT infrastructure). | Up to 30 days (unless longer retention is required to investigate a security incident). |
| 4.1.7. Website analytics and embedded third-party content (Google Analytics 4, YouTube player) | Online identifiers, cookie data, aggregated browsing statistics, IP address (anonymised in GA4), interaction with embedded video player. | Art. 6(1)(a) GDPR (visitor's prior consent) and Art. 73 of the Law on Electronic Communications. | Consent cookie: 12 months. GA4 cookies: up to 24 months (GA4 event data retention: 14 months). See our Cookie Policy for details. |
4.2. No direct marketing or automated profiling: The Company does not send direct marketing newsletters or promotional messages without prior consent and does not carry out automated decision-making or profiling producing legal effects within the meaning of Article 22 of the GDPR.
5. Sources of Personal Data
5.1. We collect personal data directly from you when you fill in forms on the Website ("Request a Sample", "Contact Sales", "General Enquiries", "Register"), contact us by email, phone, or in person, apply for a job vacancy, or enter into a business relationship with us.
5.2. Certain technical data are generated automatically when you browse the Website (strictly necessary server logs and language preference cookie, as well as analytics or embedded content cookies if and only if you grant consent via the cookie banner).
6. Recipients of Personal Data and Data Processors
6.1. The Company does not sell or rent your personal data. Personal data may be disclosed only where necessary and proportionate to:
- IT, hosting, and CRM service providers acting as data processors on our documented instructions (including server hosting infrastructure in the EU and CRM lead management system Bitrix24);
- Postal, courier, and logistics providers (solely for delivering requested product samples or goods);
- Analytics and embedded content providers – Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Analytics 4 and YouTube privacy-enhanced video player, exclusively when you have given prior consent to the respective cookie category;
- Professional advisors, auditors, legal representatives, and banks where necessary for accounting, legal compliance, or defence of legal claims;
- Competent state, regulatory, law enforcement, or judicial authorities where required under applicable law.
7. Transfers of Personal Data Outside the European Economic Area (EEA)
7.1. As a rule, the Company stores and processes personal data within the territory of the European Union / European Economic Area (EEA).
7.2. Where you consent to analytics cookies (Google Analytics 4) or embedded content cookies (YouTube), certain technical data may be transferred to or accessed by Google LLC in the United States. Such transfers are carried out in accordance with Chapter V of the GDPR on the basis of:
- the European Commission's Adequacy Decision under Article 45 GDPR for the EU–US Data Privacy Framework (DPF) (in which Google LLC is certified); and/or
- Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR.
8. Cookies and Third-Party Embedded Content
8.1. Non-essential cookies (Google Analytics 4) and third-party embedded content (YouTube videos) are blocked by default and are loaded only if you actively grant consent via our cookie consent tool. Detailed information about the cookies used, their providers, purposes, and validity periods is provided in our Cookie Policy.
8.2. You can review, change, or withdraw your cookie consent at any time by clicking the "Cookie settings" link in the Website footer.
9. Technical and Organisational Security Measures
In accordance with Article 32 of the GDPR, the Company implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, including encrypted HTTPS/TLS transmission, access control and role-based permissions, password hashing, regular backups, and staff confidentiality obligations.
10. Your Rights as a Data Subject
Under Articles 15–22 and Article 7(3) of the GDPR, you have the following rights:
- Right to be informed about the processing of your personal data (Articles 13–14 GDPR);
- Right of access to your personal data processed by the Company and to receive a copy thereof (Article 15 GDPR);
- Right to rectification of inaccurate or incomplete personal data (Article 16 GDPR);
- Right to erasure ("right to be forgotten") where the data are no longer necessary, consent is withdrawn, or processing is unlawful (Article 17 GDPR);
- Right to restriction of processing in the cases set out in Article 18 GDPR;
- Right to data portability for data processed on the basis of consent or contract by automated means (Article 20 GDPR);
- Right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests under Article 6(1)(f) GDPR (Article 21 GDPR);
- Right to withdraw consent at any time where processing is based on your consent under Article 6(1)(a) GDPR, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).
11. Procedure for Exercising Your Rights
11.1. You may submit a request to exercise your rights by emailing office@finegri.com or by sending a written request to UAB "FINEGRI", Pramonės g. 26A, LT-94103 Klaipėda, Republic of Lithuania.
11.2. Where we have reasonable doubts concerning the identity of the natural person making the request, we may request additional information strictly necessary to confirm your identity in accordance with Article 12(6) of the GDPR.
11.3. We will respond to your request without undue delay and in any event within one (1) month of receipt of the request, free of charge (Article 12(3) GDPR). That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within one month.
12. Right to Lodge a Complaint with a Supervisory Authority
If you believe that your personal data are being processed in infringement of the GDPR or applicable data protection laws, you have the right under Article 77 of the GDPR to lodge a complaint with the supervisory authority in the Republic of Lithuania or in the EU Member State of your habitual residence, place of work, or place of the alleged infringement:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI)
Address: L. Sapiegos g. 17, LT-10312 Vilnius, Republic of Lithuania
Phone: +370 5 271 2804 / +370 5 279 1445
Email: ada@ada.lt
Website: https://vdai.lrv.lt
13. Final Provisions and Policy Updates
13.1. This Policy is reviewed regularly (at least once per year) and updated whenever legal requirements or the Company's data processing operations change. The current version is always available on the Website at https://finegri.com/privacy-policy.
13.2. Current version: Version 1.0, approved on 20 October 2026, effective from 1 November 2026.
