Privacy Policy | Mango Insurance

PRIVACY AND COOKIE POLICY

The controller of your personal data is either: Mango Insurance, UAB (legal entity code 306010506, registered office address: Aludarių g. 1, LT-01113, Vilnius); Mango Insurance, SIA (legal entity code 40203490873, registered office address Tērbatas iela 14-3, LV-1011, Rīga); or Mango Insurance, SIA Eesti filiaal (legal entity code 17054253, registered office address: Seebi tn 1-1501,11316, Tallinn, Eesti) (hereinafter – MANGO or We).

For more detailed information please refer to your local MANGO data controller.

When processing personal data, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter – the Regulation), the Laws on Legal Protection of Personal Data, the Laws on Electronic Communications, and the requirements of other related legal acts, as well as the instructions of supervisory authorities.

WHAT IS PERSONAL DATA AND HOW IS IT PROCESSED?

Personal data means any information directly or indirectly related to you where your identity is known or can be directly or indirectly determined by using the relevant data (e.g., name, surname, personal identification number, email address, telephone number, etc.).

Processing of personal data means any operation performed on personal data, including collection, recording, storage, editing, alteration, granting access, submitting queries, transfer, archiving, etc.

When processing your personal data, we comply with the following principles of personal data processing:

Your personal data is processed only to the extent necessary to achieve the respective clearly defined and legitimate purposes, considering the protection of your privacy;
Your personal data is processed accurately, fairly, and lawfully, and only for such purposes as are consistent with the purposes specified prior to the collection of your personal data;
Your personal data is processed in strict compliance with the clear and transparent requirements for personal data processing established by legal acts;
Your personal data is processed only in such a form that your identity can be established for no longer than is necessary for the purposes for which the personal data is processed;
Appropriate technical and organizational measures are applied to the processing of your personal data to ensure the security of personal data, including protection against unlawful processing and against accidental loss, destruction, and damage.

ON WHAT GROUNDS, FOR WHAT PURPOSES, AND UNDER WHAT CONDITIONS DO WE PROCESS YOUR PERSONAL DATA?

For the purpose of concluding and performing insurance contracts we process the following of your data: name, surname, personal identification number, residential address and contact details, bank account number, data contained in identity documents, risk assessment data, registration data of the insured property, and data submitted (received) during the loss event. Data retention period: 10 years from the end of the contract.
Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and to comply with a legal obligation applicable to the data controller.
For the purpose of selecting employees (trainees) and assessing compliance with the requirements established by legal acts we process the following of your data: name, surname, contact details, CV, data contained in the motivation letter, qualification, recommendations and selection assessment data, as well as criminal conviction and bankruptcy case data. Data retention period: until the end of the selection process, and if the data is retained for future selection processes – for as long as the candidate's consent remains valid.
Legal basis: Article 6(1)(a), (b), and (c) of the Regulation, i.e., data is processed on the basis of the data subject's consent, and processing is also necessary for the performance of a contract to which the data subject is a party and in order to comply with a legal obligation applicable to the data controller.
For the purpose of concluding and performing employment contracts and assessing compliance with the requirements established by legal acts we process the following of your data: name, surname, personal identification number, date of birth, residential address, contact details, bank account number, qualification and employment administration data, as well as criminal conviction and bankruptcy case data. Data retention period: 50 years from the end of the contract.
Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and to comply with a legal obligation applicable to the data controller.
For the purpose of concluding and performing internship contracts and assessing compliance with the requirements established by legal acts we process the following of your data: name, surname, personal identification number, date of birth, residential address, contact details, bank account number, qualification and employment administration data, as well as criminal conviction and bankruptcy case data. Data retention period: 10 years from the end of the contract.
Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and to comply with a legal obligation applicable to the data controller.
For the purpose of accounting and payment administration we process the following of your data: name, surname, bank account number, personal identification number (date of birth), address, contact details, VAT payer data, and data contained in invoices, payments, bank details, and accounting documents. Data retention period: invoices and most other financial accounting documents are retained for 10 years or for other retention periods for financial accounting documents established by legal acts.
Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and to comply with a legal obligation applicable to the data controller.
For the purpose of examining requests, complaints, and notifications submitted by individuals we process the following of your personal data: name, surname, email address, residential address, telephone number, representative's name and surname, date and number of the complaint or request, the date and number of registration with Mango, the information indicated in the complaint or request, and the results of the examination of the complaint or request. Data retention period: 10 years from the date of adoption of the decision.
Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and in order to comply with a legal obligation applicable to the data controller.
For the purpose of concluding and administering vehicle rental or loan-for-use agreements we process the following of your personal data: name, surname, contact details, personal identification number, residential address, registration data of the vehicle used, and bank account data. Data retention period: 10 years from the end of the contract.
Legal basis: Article 6(1)(b) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party.
For the purpose of concluding and performing cooperation agreements we process the following of your personal data: name, surname, position, contact details, representation and signature data, information on contract performance, bank account data, and, in the case of an insurance intermediation agreement, also criminal conviction and bankruptcy case data. Data retention period: 10 years from the end of the contract. Legal basis: Article 6(1)(b) and (c) of the Regulation, i.e., data processing is necessary for the performance of a contract to which the data subject is a party and to comply with a legal obligation applicable to the data controller.
For the purpose of recording telephone conversations in order to ensure proper service provision and high-quality customer service we process the following of your personal data: the employee's name and surname, the employee's identification number (code) in the system, workplace number, the client's telephone number, the date, time, and duration of the conversation, and the information provided during the conversation. Data retention period: 6 months from the date the recording was made.
Legal basis: Article 6(1)(a) and (f) of the Regulation, i.e., personal data is processed based on the data subject's consent, and processing is also necessary for the purposes of the legitimate interests pursued by the data controller.
For the purpose of improving the website and collecting statistical information we process the following of your data: IP address, device and browser data, cookie and plug-in identifiers, website usage data, and approximate location. Data retention period: the retention period of personal data depends on the cookie used to collect the personal data, however, in all cases, the retention period is not longer than 2 years. Specific periods are indicated in the Cookies section of the Privacy Policy.
Legal basis: processing is necessary for the purposes of the Company's legitimate interests in ensuring the operation of the website (Article 6(1)(f) of the Regulation) (personal data collected by necessary cookies is processed on this basis), and your consent to the processing of personal data for this purpose (Article 6(1)(a) of the Regulation) (personal data collected by non-essential cookies is processed for this purpose).
For the purpose of direct marketing, we process the following of your personal data: name, surname, mobile telephone number and/or email address, the fact of confirmation and withdrawal of consent, and the date and/or time thereof. Data retention period: 2 years from the end of the validity of consent. Legal basis: Article 6(1)(a) of the Regulation, i.e., the data subject has given consent.

WHERE DO WE OBTAIN YOUR PERSONAL DATA FROM?

We process your personal data obtained from the following sources:

a) When you provide it to us. You provide us with your personal data when you use our services, send us your CV and motivation letters, and communicate with us by telephone, email, or during meetings.

b) When you use our website. When you use our website, certain information (e.g., internet protocol address (IP), type of web browser used) is collected automatically.

c) From third parties. In the cases and in accordance with the procedure established by legal acts and/or this Privacy Policy, we may also obtain your personal data from third parties, for example, we receive your personal data from our partners, public authorities and institutions, and banks, from which we are required (or entitled) to collect such data under the applicable laws.

WHO ARE THE RECIPIENTS AND PROCESSORS OF YOUR PERSONAL DATA?

Data recipients

Where there is a lawful basis, your personal data may be disclosed to state and municipal authorities, supervisory and law enforcement authorities, courts, bailiffs, notaries, auditors, legal and other consultants, insurance companies, insurance intermediaries, banks and payment service providers, as well as to other persons where disclosure of the data is provided for by legal acts or where this is necessary to assert, exercise, or defend legal claims.

Upon receipt of your consent, we may also disclose personal data to other data recipients.

If we disclose your personal data to categories of data recipients other than those specified in this Privacy Policy, we will inform you thereof no later than at the time of the first disclosure of the data, unless we have already provided you with such information earlier.

Data processors

We may engage data processors who process personal data on our behalf and in accordance with our instructions, for example, distributors of insurance products, companies providing document storage, archival management and confidential destruction services, banks, operators, companies providing financial and payment services, entities providing data processing services, a company providing data centre services, companies performing and providing internet browsing or online activity analysis services, companies developing, providing, maintaining and improving software, companies providing accounting services, companies providing information technology infrastructure services, companies providing communication, security, recruitment, and call handling services, and other service providers to whom your personal data is disclosed only to the extent necessary for the provision of their services.

Data processors process your personal data only in accordance with our instructions and only to the extent necessary to properly perform the obligations set out in the contract. We seek to ensure that data processors have implemented appropriate technical and organizational measures to ensure the security and confidentiality of your personal data.

WHAT IS THE GEOGRAPHICAL SCOPE OF THE PROCESSING OF YOUR PERSONAL DATA?

We process your personal data within the territory of the European Union or the European Economic Area.

In certain cases, when we use service providers or partners operating outside the European Union and/or the European Economic Area, your personal data may also be transferred to third countries.

Where personal data is transferred to countries in respect of which the European Commission has adopted an adequacy decision, the data is transferred based on such decision. In other cases, the data is transferred only subject to the application of the standard contractual clauses approved by the European Commission or other appropriate safeguards provided for by legal acts.

For additional information about the safeguards applied, you may contact us using the contact details provided in this Policy.

DOES MANGO CARRY OUT AUTOMATED DECISION-MAKING AND PROFILING?

MANGO does not carry out profiling or automated decision-making that would produce significant consequences for you or otherwise have a significant effect on you.

COOKIES

The website uses cookies – small pieces of textual information that are automatically created while browsing the website and are stored on a computer or another terminal device.

The information collected by cookies allows for more convenient browsing of the website, enables the provision of electronic services and offers, and helps us learn more about the behavior of users of our websites, analyze trends, and improve the website and the services provided. If the Company's website contains links to other websites that also use cookies, such cookies are not described herein.

When functional, tracking, advertising and/or third-party cookies are placed, we request your consent. When strictly necessary cookies are placed, we use them on the basis of legitimate interest and do not request your consent for the placement of such cookies. If we have already obtained your consent, we will not request it again in the future when the same cookie is used again for the same purpose. This also applies in relation to cookies used by third parties.

The consent given for the use of non-essential cookies may be withdrawn at any time by changing the settings of the internet browser, disabling all cookies, or disabling (enabling) them one by one. Please note that in some cases this may slow down internet browsing, limit the operation of certain website functions, or block access to the website. To set the required (preferred) cookie choices, it is recommended to use the functions available in the cookie notice or internet browsers.

You may change your cookie settings at any time in the cookie notice window, which you can find by clicking the always-visible icon in the lower left corner of the website. Please note that by deleting cookies or disabling the use of cookies in the future, you may not be able to access certain parts or functions of our website.

The following types of cookies are used on the websites:

Strictly necessary cookies. To make the website easier to use, strictly necessary cookies activate core functions, such as page navigation and access to secure areas of the website. Without these cookies, the website will not function properly.
Preference cookies. Preference cookies enable the website to remember information that changes the way the website behaves or looks, such as your preferred language or the region in which you are located.
Statistical cookies. By using statistical cookies, which collect anonymous information and provide reports on it, website owners can learn how visitors interact with the website.
Marketing cookies. Marketing cookies are used to track visitors across websites. The intention is to display advertisements that are tailored to and relevant for the individual user, and therefore more valuable to publishers and third-party advertisers.

The following cookies are used on the website:

The website operated by MANGO uses plugins and tracking integrations (“social plugins” and tracking technologies). They are installed to enable users of the website to be redirected to our accounts on social networks, to carry out the measurement of advertising campaigns, and to perform audience/conversion tracking. At present, at least the following plugins/integrations are identified: “Facebook” and “Facebook Pixel”, “LinkedIn” social plugins, and “Adform” tracking technologies.

By clicking on the plugin icon, you are redirected to the page of the plugin controller, and the plugin controller is provided with data indicating from which page the request was made, as well as the time and date of the request. The plugins are identifiable by the “Facebook” and “LinkedIn” logos.

The information that a person provides on the page of the plugin controller or that is obtained when the person visits the links of plugins contained on the Company's website is controlled by the plugin controllers. Information about the personal data collected and stored, the legal bases for data processing, data retention periods, and the technical and organizational security measures applied is provided in the privacy notices of the plugin controllers.

WHAT ARE YOUR RIGHTS?

Regarding your personal data, to the extent, in the cases, under the procedure and conditions provided for by the applicable legal acts, considering the applicable restrictions, you have the following rights:

To access your personal data and information on how it is processed (e.g., you may contact us with a request to confirm that we process your personal data);

To request the rectification of incorrect, inaccurate, or incomplete data (MANGO has the right, before rectifying your personal data, to verify its accuracy);

To request the erasure of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent and the processing of personal data was based on consent, where you have exercised your right to object to the processing of personal data relating to you, etc.

To restrict the processing of your personal data (e.g., to store it, but not use it);

To request the transfer of your personal data to another controller or to have it provided directly to you in a convenient format (this applies to the personal data that you provided and that is processed by automated means based on a contract or consent);

To object to the processing of your personal data where it is processed based on legitimate interest, except where our legitimate interest overrides your legitimate interest or is related to the establishment, exercise, or defense of legal claims;

To withdraw the consent given at any time where your personal data is processed based on consent;

To lodge a complaint with us and/or the State Data Protection Inspectorate;

To object to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you.

HOW CAN I EXERCISE MY RIGHTS?

To exercise your rights or submit a complaint regarding the processing of your personal data, you may contact us by email at dpo@mangoinsurance.eu. Upon receipt of your request and, where necessary, after verifying your identity, we will respond no later than within 1 month of receipt of the request. If, due to the complexity or number of requests, it is not possible to comply with this time limit, the period may be extended by a further 2 months, and you will be informed thereof within 1 month from receipt of the request.

You also have the right to apply to the State Data Protection Inspectorate or the national courts, according to your local MANGO data controller (processor):

Lithuania: Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, email address ada@ada.lt, website https://vdai.lrv.lt.

Latvia: Datu valsts inspekcijā, Elijas iela 17, Rīga, LV-1050, email address pasts@dvi.gov.lv, website https://www.dvi.gov.lv/lv.

Estonia: Andmekaitse Inspektsioon, Tatari 39, Tallinn 10134, email address info@aki.ee, website https://www.aki.ee/.

CHANGES TO THE PRIVACY POLICY

MANGO may update the Policy at any time. MANGO will inform you of updates by publishing a new version of the Policy on the website together with the date of the most recent amendments.

If you have any questions related to the processing of your personal data and/or this Policy, or if you have any suggestions, we invite you to contact us.

HOW TO CONTACT US?

If you have any questions related to the Policy or any requests concerning the processing of your personal data, you may contact us:

By email: dpo@mangoinsurance.eu

Privacy Policy update date: 2026-06-01