JSC “Raminora” respects the privacy of its guests, clients, website visitors and other interested parties and is committed to processing their personal data lawfully, fairly, transparently and securely.
This Privacy Policy explains what personal data we collect, the purposes and legal bases for processing it, to whom we may disclose it, how long we retain it and what rights you have.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other applicable legislation.
Who is the controller of your personal data?
The controller of your personal data is JSC „Raminora“.
Address: K. Dineikos st. 1, LT-66165 Druskininkai.
Website: www.spavilnius.lt
Email for personal data protection matters: [email protected]
If you have any questions about the processing of your personal data or wish to exercise your rights as a data subject, you may contact us using the email address or postal address provided above.
What personal data do we collect?
Depending on the services you use and how you interact with us, we may process the following personal data:
- your first name, surname and other identification data;
- contact details, such as your telephone number and email address;
- reservation, registration and stay information;
- information about services ordered and provided;
- payment and invoicing information;
- information contained in your enquiries, requests and correspondence;
- information about your choices and preferences where necessary to provide our services;
- information about your direct marketing consents and preferences;
- website usage and technical data, including your IP address, where such data is collected;
- video surveillance data in areas where video surveillance is carried out;
- recordings of telephone calls where calls are recorded;
- other data that you provide to us when using our services.
Where it is necessary to process health data in connection with wellness, medical treatment or other relevant services, we process such data only where an appropriate legal basis applies and in accordance with the requirements of the GDPR and other applicable legislation governing special categories of personal data.
How do we obtain your personal data?
We may obtain your personal data:
- directly from you when you make a reservation, register, purchase or use our services;
- when you contact us by telephone, email, through our website or via other communication channels;
- through our website www.spavilnius.lt;
- through electronic reservation systems and other service booking channels that we use;
- from third parties where they lawfully provide us with your data, for example, reservation partners, insurance companies or a person making a reservation on your behalf;
- through video surveillance systems;
- by recording telephone calls where such recording takes place and you have been appropriately informed about it;
- through cookies and similar technologies in accordance with your preferences, except for technologies that are strictly necessary for the proper functioning of the website.
For what purposes and on what legal bases do we process your data?
Reservation and provision of services
We process your data in order to:
- accept and manage reservations;
- complete registration;
- provide accommodation, SPA, wellness, medical treatment, catering and other services you have ordered;
- administer payments and issue invoices;
- contact you regarding your reservation or the provision of services;
- manage matters related to the services provided.
We process this data where necessary to enter into and perform a contract with you or to take steps at your request prior to entering into a contract, as well as to comply with our legal obligations.
Service quality and communication
We may process your contact details and information related to the services provided in order to respond to your enquiries, manage feedback, resolve issues and improve the quality of our services.
Depending on the specific circumstances, such data is processed for the performance of a contract, compliance with legal obligations or on the basis of our legitimate interest in ensuring appropriate customer service and service quality.
Direct marketing
If you have given your consent, we may use your contact details to send you newsletters, information about SPA VILNIUS services, offers, news and other marketing communications.
You may withdraw your consent to receive direct marketing communications at any time by clicking the unsubscribe link in an email or by contacting us at [email protected].
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Safety of persons and property
We may use video surveillance to ensure the safety of guests, employees and other persons, as well as their property and the property of JSC “Raminora”, to prevent incidents and to protect our legitimate interests.
Video surveillance data is processed on the basis of our legitimate interests, taking into account the rights and interests of data subjects.
Recording of telephone calls
Some telephone calls may be recorded for the purposes of ensuring service quality, preventing disputes and misunderstandings or for other purposes communicated to you before the recording begins.
Before recording begins, we provide information about the recording and essential information concerning the processing of personal data.
Who may we disclose your personal data to?
We disclose your personal data only where there is a lawful basis for doing so and where disclosure is necessary for a specific purpose.
Depending on the circumstances, data may be disclosed to:
- our employees and specialists providing services, to the extent that the information is necessary to provide the relevant services;
- providers of IT, information systems, hosting, cloud and other technology services;
- reservation and booking management service providers;
- payment and financial service providers;
- electronic communications and communication service providers;
- marketing and communication service providers where there is an appropriate legal basis;
- insurance companies where you use services paid for by them;
- auditors, lawyers and other professional advisers where necessary;
- public authorities, law enforcement agencies, supervisory authorities and other institutions where we are required to provide information by law;
- other persons where you have given your consent or where disclosure is permitted on another lawful basis.
Where we engage data processors, we require them to process your personal data only in accordance with our instructions, implement appropriate technical and organisational security measures and comply with applicable data protection requirements.
Transfers of data outside the European Economic Area
Some of the service providers we use may process personal data outside the European Economic Area (EEA).
In such cases, we transfer personal data only in accordance with the requirements of the GDPR and apply appropriate safeguards, such as an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another transfer mechanism provided for by applicable legislation.
7. How long do we retain your personal data?
We retain personal data no longer than necessary to fulfil the purposes for which it was collected or for as long as required by applicable legislation.
Different retention periods may apply to different categories of data, depending on the purpose of processing, legal obligations, limitation periods for potential claims or disputes and other legitimate requirements.
For direct marketing purposes, we process your data for as long as your consent remains valid, but no longer than the retention period established by us. If you withdraw your consent, we will stop using your data for direct marketing purposes, except for information that must be retained to ensure that your preference is respected in the future.
Video surveillance footage and telephone call recordings are retained for periods established by UAB “Raminora”, taking into account the purpose of processing and applicable legal requirements.
How do we protect your personal data?
We implement appropriate technical and organisational measures designed to protect your personal data against unlawful or accidental destruction, loss, alteration, disclosure, unauthorised access or other unlawful processing.
Access to personal data is granted only to those employees, specialists and service providers who require it to perform their duties.
What rights do you have?
In the circumstances provided for by the GDPR and other applicable legislation, you have the right to:
- receive information about the processing of your personal data;
- access the personal data we process about you;
- request the correction of inaccurate personal data or completion of incomplete personal data;
- request the deletion of your personal data (the “right to be forgotten”);
- request that the processing of your personal data be restricted;
- object to the processing of your personal data where processing is based on legitimate interests;
- object at any time to the use of your personal data for direct marketing purposes;
- where applicable, receive the personal data you have provided in a structured, commonly used and machine-readable format and transmit that data to another data controller;
- where processing is based on your consent, withdraw your consent at any time;
- lodge a complaint with a supervisory authority.
These rights are not absolute and may be restricted in certain circumstances provided for by law.
How can you exercise your rights?
You can submit a request concerning your personal data:
By email: [email protected]
In writing: JSC „Raminora“, K. Dineikos st. 1, LT-66165 Druskininkai.
To protect your personal data, we may ask you to provide information necessary to verify your identity before processing your request.
We will respond to your request without undue delay and no later than one month from the date of receipt of your request. Depending on the complexity and number of requests, this period may be extended by a further two months where permitted by law. We will inform you of any such extension and the reasons for it.
If you believe that your personal data is being processed in breach of applicable legislation, you have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (VDAI). We also encourage you to contact us first so that we can address your concerns.
Cookies and similar technologies
We use cookies and similar technologies on the website www.spavilnius.lt
We use cookies that are strictly necessary to ensure the proper functioning of the website. Other cookies and similar technologies are used in accordance with your cookie preferences and, where required, only with your consent.
Detailed information about the cookies we use, their purposes, duration, service providers and how you can change or withdraw your preferences at any time is available in our Cookie Policy. You can also change your cookie preferences at any time by selecting “Cookie settings” on the website.
Changes to the Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our activities, the technologies we use or applicable legislation.
The current version of the Privacy Policy is always available on www.spavilnius.lt.
Last updated: 24 August 2026.
