Privacy policy

The policy explains how the Lithuanian TOP Companies Registry at topimones.lt handles data. The registry is not the original controller of public company data: it collects, organises, analyses and presents data that official state registers and institutions publish and control. The policy separates two kinds of data: (1) public company data from official sources and (2) personal data you provide directly when you use the services.

The original controllers of official company data (financial statements, taxes, employees, court cases, registration and other data) are state institutions: the Centre of Registers, the State Tax Inspectorate (VMI), the State Social Insurance Fund Board (SODRA), the State Patent Bureau (VPB), Regitra, the Authority of Audit, Accounting, Property Valuation and Insolvency Management (AVNT) and others. The registry only republishes, combines and analyses these public data. For the data you provide directly (accounts, enquiries, reviews) the registry is the controller; it can be reached through the contact form.

From official sources the registry processes public data on legal entities: name, code, VAT code, address, managers and participants, financial indicators, tax obligations and arrears, headcount and average salary, public procurement, trademarks, vehicles, court cases, and bankruptcy and restructuring proceedings. Most of these data concern legal entities and are not personal data. Where natural persons appear (for example managers or participants from public registers), they are processed on the basis of the legitimate and public interest in business transparency (GDPR Article 6(1)(e) and (f)), because the data are already public in the official registers. Main sources: the Centre of Registers, VMI, SODRA, VPB, Regitra, AVNT, JADIS, LITEKO, the Public Procurement Office, Statistics Lithuania, GLEIF and the data.gov.lt open data sets.

• TINKLAS account: first name, surname, email, telephone, company, position.
• Enquiries and the contact form: name, email, telephone and the content of the message.
• Reviews and ratings: the content you submit and your account data.

These data are processed to perform a contract (provide the service), on the basis of your consent or of legitimate interest. Without them the corresponding functions cannot be provided.

The registry calculates the EBRS business reputation score automatically from public state register data, using one methodology published in the methodology section; it assesses legal entities. This is automated processing for business transparency and is not used to take legal decisions about natural persons. Company representatives can submit comments or ask for data to be corrected (section 12).

AI search lets users ask about assessed companies in natural language. Queries are processed with artificial intelligence and may be stored temporarily for service quality, security and abuse prevention. GEO visibility services (in the Lyderis packages) optimise a company's public profile for AI search systems; they process public company data and, when used while signed in, your account data.

The site uses strictly necessary cookies (sign-in session and security); they are required for the services to work. Visit statistics are collected in two ways.

First, the registry's own measurement system on its own server. It sets no cookie and does not store the IP address: the address, together with the browser identifier and a secret key that changes every day, is turned into an irreversible cryptographic hash. The key is replaced every night and the old one destroyed, so records cannot be linked to a person or a user followed from one day to the next. Records are kept for at most 400 days.

Second, Google Analytics 4 (provider Google Ireland Limited), switched on only if you tick the “Analytics” category in the cookie banner. Before consent it runs in Consent Mode: no cookies are set and only cookieless signals not linked to a person are sent to Google. With consent the cookies _ga and _ga_G-D9SH1DN8S9 are set (valid for 2 years). Advertising and profiling features are off in all cases. Data may be transferred outside the European Economic Area under standard contractual clauses approved by the European Commission. The tool does not run in the administration area. Consent can be withdrawn or changed at any time in the cookie settings; measurement stops immediately.

Personal data are not sold. They may be disclosed only to service providers (cloud hosting, email delivery, AI processing) working under contract and only on the registry's instructions, and to competent authorities where the law requires it. Public company data are publicly available in line with the purpose of the service.

Where service providers outside the European Economic Area are used (for example for AI services), transfers rely on appropriate safeguards under the GDPR, including standard contractual clauses.

Public company data are kept for as long as they are relevant to the purpose of the registry and are updated from the official sources; historical data (for example former names or financial history) are kept in the public interest in transparency. Account data are kept while the account is active and for a reasonable period after it is closed, as the law requires. Enquiry and correspondence data are kept for as long as needed to handle the enquiry and for accounting purposes.

You have the right to access your personal data, to have them corrected or erased, to restrict or object to processing, to data portability and to withdraw consent. Facts from public registers (for example a company's finances or managers) can only be republished from the official sources, so the original correction must be made with the controller concerned (for example the Centre of Registers); the registry then updates its copy promptly. Rights are exercised through the contact form. You may also lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt).

An inaccuracy can be reported with the error-report function on the company page or through the contact form. When the inaccuracy comes from an official register, the original source should also be contacted: the registry updates its data from those sources regularly, daily or as often as the source publishes. The steps are described in the corrections process.

Organisational and technical measures protect the data: access control, encrypted connections, hashed password storage and activity logs. Complete security on the internet cannot be guaranteed, and the measures are improved continuously.

The policy may be updated; the current version is always published on the Lithuanian page with its effective date. Questions about data processing go through the contact form (see about the operator).

• About the operatorWho runs the registry, how to reach us and why the score cannot be bought.
• Corrections processHow to report an error in a company profile and what happens next.
• Data statusWhen each data source was last updated, checked against its schedule.
• Terms of use (summary)The rules for using the registry. An informative English summary; the Lithuanian text prevails.
• Algorithms and version historyEvery EBRS formula, null condition and confidence rule, and every methodology version.