Privacy notice
Last updated:
This notice covers the whole Agency Due Diligence portal: clients, recruitment agencies, partner applicants and references.
1. Controller
The controller of your personal data is MB "Ugnilo", company code 306109027, Lithuania, trading as HRServices Lithuania (hrservices.lt).
Privacy contact: ilona@hrservices.lt.
2. Whose data we process and what data
Representatives of client companies across Europe, including EU/EEA countries: name, email, phone, company details, account and order data.
Recruitment agencies and partner applicants: contact person details, owners’ and directors’ names, licence and company documents, questionnaire answers and EU client references’ contact details.
Technical data: consent timestamp, IP address, login records and audit log.
3. Purposes and legal bases
Providing the due-diligence service to clients — contract (GDPR Art. 6(1)(b)).
Assessing agencies and partner applications, including sanctions screening and fraud and forced-labour risk checks — legitimate interests (GDPR Art. 6(1)(f)). Our interest is to assess reliable and lawful recruitment partnerships and protect clients and workers from these risks.
Security, abuse prevention and audit trail — legitimate interests in protecting the portal and maintaining accountability (GDPR Art. 6(1)(f)).
Legal obligations, such as accounting requirements — legal obligation (GDPR Art. 6(1)(c)).
4. Automated tools
An AI service helps extract data and flag possible issues. All decisions are made by a human reviewer. No decisions with legal or similarly significant effects are made solely by automated means.
5. Recipients
Hosting, database and AI service providers act as processors under data processing terms. Clients receive only the due-diligence report about the agency they ordered, never a partner applicant’s raw documents. Data may be provided to authorities where required by law.
6. International transfers
Some providers may process data outside the European Economic Area (EEA). Such transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. To request information about the applicable safeguards or a copy, contact the email below.
7. Retention periods
- Client account and order data and reports
- 5 years after the last order (accounting and claims).
- Partner applications not approved
- 12 months after the decision.
- Approved partners
- For the duration of cooperation plus 3 years.
- Uploaded documents for client orders
- 12 months after the report unless needed for a dispute.
- Security logs
- 12 months.
8. Your rights
You have rights of access, rectification, erasure, restriction, objection and data portability where applicable. To exercise your rights, email ilona@hrservices.lt. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): www.vdai.lrv.lt.
9. Providing data about others
Applicants must only submit owners’, directors’ and references’ data they are entitled to share and should inform them about the processing and this notice. Do not upload candidate identity documents.
10. Updates
We may update this notice when our data processing changes. The last updated date is shown at the top.
Portal technologies and visitor analytics
The sign-in service stores account and login data with our hosting and database provider, Lovable Cloud. Your browser stores your sign-in session to keep you signed in and your chosen language. Submitted information and documents are stored privately; data needed for review may be sent to the AI service described above.
Fonts are loaded from Google Fonts. When loading fonts, Google receives your IP address and technical request data.
On the published site, Lovable’s visitor analytics records pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and button and link clicks. There is currently no consent banner: clicks are recorded for every visitor except those whose browser sends Global Privacy Control. Page visits, time on page, page speed and errors are recorded for every visitor, without cookies and without identifying anyone.
Lovable’s analytics uses no cookies, stores nothing on the visitor’s device, does not keep IP addresses and does not identify visitors. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.