Personal data protection | GDPR compliance

BNM Finance is a team of accounting and financial management experts. Protecting the information our clients entrust to us matters to us as much as the quality of our services.

Privacy policy

1. General provisions and data controller

This privacy policy explains how BNM Finance processes the personal data of clients, their representatives, website visitors, job candidates and other individuals. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts.

Name UAB „BNM Finance“
Company code 302427776
Registered office Perkūnkiemio g. 7, LT-12131 Vilnius, Lithuania
Branches Kaunas (Veiverių g. 139), Klaipėda (H. Manto g. 7), Tauragė (Dariaus ir Girėno g. 22)
Email labas@bnmfinance.lt
Phone +370 520 00 111
Data protection officer dpo@bnmfinance.lt

When we process the data of our clients’ employees and counterparties while providing accounting, payroll or other services, we act as a data processor on the client’s instructions and under a data processing agreement. In such cases, please contact the relevant client – the data controller – first regarding your rights.

2. What data we collect

We collect only the data needed for a specific purpose.

  • Clients and their representatives: name, surname, position, company, email, phone number, signature, contract and invoice data, correspondence.
  • Client identification (AML/CTF) data: identity document details, date of birth, citizenship, information on beneficial owners and politically exposed persons.
  • Data processed on behalf of clients: data of clients’ employees, customers and suppliers contained in accounting documents, payroll and tax returns.
  • Website visitors: data submitted in the inquiry form (name, company, email, phone, question), newsletter subscription email, IP address, cookie and browsing data.
  • Job candidates: CV, contact details, education, work experience, selection results.
  • Debt management: debtors’ contact details and debt information received from the creditor.

We receive data from you directly, from our clients (your employer or counterparty), from public registers (the Centre of Registers, the State Tax Inspectorate) and from job portals.

3. Purposes, legal bases and retention periods

We apply a specific legal basis under Article 6 GDPR to each purpose. When the retention period ends, we delete or anonymize the data.

Purpose Legal basis Retention period
Providing services, concluding and performing contracts Performance of a contract (Art. 6(1)(b)) For the term of the contract and 10 years after it ends
Fulfilling accounting and tax obligations Legal obligation (Art. 6(1)(c)) 10 years, or longer if required by the Index of Document Retention Periods
Client identification under the Law on the Prevention of Money Laundering and Terrorist Financing Legal obligation (Art. 6(1)(c)) 8 years after the end of the business relationship
Responding to inquiries Legitimate interest or steps prior to entering into a contract (Art. 6(1)(b), (f)) 1 year after the last correspondence
Newsletter and direct marketing Consent (Art. 6(1)(a)); for existing clients – legitimate interest Until you withdraw consent or unsubscribe
Recruitment Steps prior to entering into an employment contract; for future recruitment – consent Until the end of the selection; with consent – 1 year
Debt recovery on behalf of creditors Legitimate interest (Art. 6(1)(f)) Until the debt is recovered and 10 years thereafter
Establishing, exercising and defending legal claims Legitimate interest (Art. 6(1)(f)) Until the dispute ends and the appeal period expires
Website operation and analytics Consent (cookies) According to cookie lifetimes, see section 5

We do not make automated decisions that produce legal effects concerning you (Art. 22 GDPR).

4. Data recipients and transfers

We do not sell data. We share it only to the extent necessary to provide services or comply with legal requirements:

  • Public authorities: the State Tax Inspectorate, Sodra, the Centre of Registers, the Financial Crime Investigation Service, courts and law enforcement – where required by law.
  • Data processors: providers of accounting software, CRM and inquiry forms (Bitrix24), cloud, email, IT maintenance, website hosting and analytics (Google). We conclude data processing agreements with all of them.
  • Professional advisers: auditors, lawyers, bailiffs – only to the extent needed for a specific matter.
  • Group companies and potential investors – on the basis of legitimate interest and only subject to confidentiality undertakings.

We aim to process data within the European Economic Area (EEA). If a service provider processes data outside the EEA (e.g. in the USA), we apply the safeguards set out in Chapter V GDPR: a European Commission adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.

5. Cookies and website forms

On bnmfinance.lt we always use strictly necessary cookies. We use analytics and marketing cookies only with your consent given in the cookie banner. You can change your consent at any time in the cookie settings. The list of cookies, their purposes and lifetimes is provided in the Cookie policy.

The inquiry form runs on Bitrix24 and is protected from bots by Google reCAPTCHA. reCAPTCHA may process your IP address and device data in accordance with the Google Privacy Policy.

6. Data security

We protect data with organizational and technical measures appropriate to the risk:

  • access to data is granted only to employees who need it for their work;
  • employees sign confidentiality undertakings and receive regular training;
  • we use two-factor authentication, encrypted communication channels and backups;
  • we assess data processors before starting to work with them.

If a personal data breach occurs, we notify the State Data Protection Inspectorate within 72 hours and, where there is a high risk, you as well.

7. Your rights

You have the right to:

  • access the data we process about you and receive a copy (Art. 15);
  • rectify inaccurate data (Art. 16);
  • erase data when it is no longer needed or is processed unlawfully (Art. 17);
  • restrict processing (Art. 18);
  • data portability to another controller (Art. 20);
  • object to processing based on legitimate interest or for direct marketing (Art. 21);
  • withdraw consent at any time – this does not affect processing carried out before withdrawal.

Send your request to dpo@bnmfinance.lt or fill in the inquiry form. We may ask you to confirm your identity. We respond free of charge within 1 month; in complex cases we may extend this by a further 2 months, informing you in advance. Some rights may be limited by law – for example, we cannot delete accounting documents before the mandatory retention period ends.

8. Contacts, complaints and changes to this policy

Please send questions about the processing of personal data to our data protection officer at dpo@bnmfinance.lt. For general inquiries, contact labas@bnmfinance.lt or +370 520 00 111.

If you believe your data is being processed unlawfully, you can lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt). We recommend contacting us first – we will do our best to resolve the issue quickly.

We review this policy at least once a year. We will announce material changes on the website. This policy takes effect on 3 October 2026.