Portal

Privacy Policy

Last updated: July 2026

This Privacy Policy is provided in English. For the Lithuanian version (Privatumo politika), please click here. In the event of any discrepancy between this English version and the Lithuanian version, the Lithuanian version shall prevail.

1. General information

  • This Privacy Policy (hereinafter – Policy) provides key information about how “X Asset Management”, UAB (hereinafter – Management Company) processes personal data of its clients, visitors to the Management Company’s website www.xam.lt, and other individuals (data subjects).
  • The Management Company is a management company licensed by the Bank of Lithuania, operating in accordance with the Law of the Republic of Lithuania on Collective Investment Undertakings for Informed Investors and other applicable legislation.
  • In its activities, when processing personal data and respecting the privacy of individuals (data subjects), the Management Company is guided by legislation regulating personal data protection, including the General Data Protection Regulation (EU) 2016/679 (GDPR).
  • This Policy may be updated. When this occurs, the Management Company publishes the new version of the Policy on its website.

2. Data controller and contact details

  • The Management Company processes personal data of its clients, their representatives and beneficial owners, visitors to the Management Company’s website, candidates for vacant positions, individuals who have submitted inquiries, and other individuals (data subjects).
  • The data controller of such personal data is the Management Company, namely:
    • X Asset Management“, UAB
    • Legal entity code: 306726224
    • Address: Vilnius str. 33-201, LT-01402, Vilnius, Lithuania      
    • Phone.: +370 659 56384
    • Email: info@xam.lt
  • If you have questions regarding this Policy or the processing of your personal data, you may contact the Management Company using the contact details provided above. To enable us to properly assess your inquiry and provide you with a response, please submit your inquiries in writing (for example, by email to info@xam.lt).

3. Processing of client personal data

Processing of personal data for the purpose of providing management company services

  • The Management Company processes personal data of its clients, their representatives and beneficial owners for the purpose of providing management company services, fulfilling contracts entered into with clients and implementing requirements set out in legislation regulating the Management Company’s activities.
  • In providing services, the Management Company may process the following personal data of its clients, their representatives and beneficial owners, including: name, surname, personal identification number, other data from identity documents, contact details, residential address, data on citizenship, data on employer and position held, data on education, profession, knowledge and experience in the field of investment and/or other data necessary for providing the relevant management company services. The Management Company may obtain this data about the client, his representatives and beneficial owners either directly from the client (his representative) or from other financial institutions or business entities (if you have contacted them regarding the management company services).
  • The Management Company may provide clients with the ability to access their individual account on the Management Company’s website, where information relevant to that client is provided in relation to the specific service being provided. Clients access their account using unique login credentials provided to them. In order to properly manage this system, the Management Company also processes additional personal data of its clients, such as: client user ID, login passwords, time of client login to the individual account, data provided by clients in applications or contracts, data on transactions performed by the client and other data. The Management Company processes such personal data in fulfillment of contracts entered into with clients.
  • In providing management company services, the Management Company stores client personal data for a minimum of 10 years from the date of the last transaction or operation or from the date the investor exits the IISKIS, except in cases where legislation provides for longer data retention periods. Information about clients’ applications (requests) to acquire or redeem investment units of the collective investment undertaking for informed investors managed by the Management Company (hereinafter – IISKIS) is stored for a minimum of 3 years after the end or termination of the relevant IISKIS activity.

Processing of personal data for the purpose of money laundering and terrorist financing prevention

  • In implementing the requirements of the Law of the Republic of Lithuania on the Prevention of Money Laundering and Terrorist Financing (hereinafter – Law), before commencing business relations, the Management Company must establish the identity of its clients, their representatives and beneficial owners. A person cannot become a client of the Management Company if the requirements specified in the Law are not properly fulfilled. For this reason, the Management Company also processes personal data of its clients, their representatives and beneficial owners for the purpose of money laundering and terrorist financing prevention.
  • The personal data required by the Law may be provided to the Management Company by the data subject themselves. Furthermore, in cases specified, procedure and grounds established by the Law, the Management Company may establish the identity of a client, his representative or beneficial owner directly without their participation (for example, by obtaining necessary information from other financial institutions and obligated entities). In properly implementing money laundering and terrorist financing prevention requirements, the Management Company may obtain additional personal data about clients, their representatives and beneficial owners from other third parties (for example, client data may be verified in databases of wanted persons, international databases containing information about persons involved in political activities, etc.).
  • The Management Company stores personal data of clients, their representatives and beneficial owners in the timeframes specified in the Law, namely 8 years from the date of end of transactions or business relations with the client (unless other legislation provides for longer data retention periods). In certain cases specified in the Law, some personal data is stored for a shorter period (for example, business relations correspondence with the client is stored for 5 years from the date of end of transactions or business relations with the client).

Processing of personal data for the purpose of implementing international sanctions

  • In implementing the requirements of the Law of the Republic of Lithuania on International Sanctions (hereinafter – International Sanctions Law), the Management Company processes personal data of its clients, their representatives and beneficial owners, as well as the Management Company’s shareholders, managers, service providers, business partners, intermediaries, their representatives and beneficial owners for the purpose of implementing international sanctions.
  • Personal data for the purpose of implementing international sanctions may be provided to the Management Company by the data subject themselves. To properly implement international sanctions, the Management Company may obtain personal data about clients, their representatives and beneficial owners, as well as the Management Company’s shareholders, managers, service providers, business partners, intermediaries, their representatives and beneficial owners from other third parties (for example, data may be verified in databases). All investors are screened against sanctions lists at the time of subscription and we conduct regular, periodic checks.
  • Personal data of clients, their representatives and beneficial owners is stored for 8 years from the date of end of transactions (or operations) or business relations with the client. Personal data of the Management Company’s shareholders, managers, service providers, business partners, intermediaries, their representatives and beneficial owners is stored for the minimum retention period established by the Chief Archivist of Lithuania.

Processing of personal data for the purpose of sending newsletters

  • The Management Company may process personal data of clients and their representatives for the purpose of sending newsletters (direct marketing). In newsletters sent by email, the Management Company provides information about its activities, newly established funds and other news related to the management company services provided.
  • For this purpose, the Management Company processes the following personal data: name, surname and email address. Personal data is processed on the basis of the Management Company’s legitimate interest.
  • Current and future clients of the Management Company have the right at any time to object to or refuse such processing of their personal data for the purpose of sending newsletters. Such objection can be expressed in writing by contacting the Management Company (for example, by email to info@xam.lt) or by clicking a link in the newsletter received.
  • The retention period for personal data of the Management Company’s clients (or their representatives) processed for the purpose of sending newsletters is 2 years from the date of end of business relations with the client, unless the client refuses to receive newsletters before the end of this period. After the expiration of the aforementioned period or upon the client’s request, the Management Company will cease processing such personal data for direct marketing purposes.

Processing of personal data for the purpose of receiving inquiries

  • The Management Company processes your personal data when you contact the Management Company by email, submit inquiries on the Management Company’s website, on the Management Company’s social media accounts or in any other way.
  • When submitting an inquiry to the Management Company, please observe at least minimal personal data protection requirements. If certain personal data is not necessary to clarify the purpose of your inquiry (complaint, letter, request), please do not provide such excessive data.
  • The Management Company processes personal data received together with your inquiry in order to properly manage inquiries, ensure quality of services provided, where necessary – fulfill various legal requirements and defend legitimate interests of the Management Company. The Management Company processes personal data received together with your inquiry on the basis of your consent, i.e. when you contact the Management Company by active actions.
  • The retention period for personal data indicated in your inquiry is up to 3 years, depending on the nature of the personal data received and other circumstances. Your personal data may be stored for a longer period if this is necessary for the defense of the Management Company’s rights and legitimate interests, proper management of inquiries, complaint review or dispute resolution, as well as in other cases provided for in legislation.

Processing of personal data for the purpose of personnel selection

  • If, when applying for a job position offered by the Management Company, you provide data about yourself (for example, you submit your CV, cover letter), the Management Company processes your personal data for the purpose of personnel selection. The Management Company processes your personal data on the basis of your consent, i.e. when you contact the Management Company by active actions.
  • Please observe at least minimal personal data protection requirements and do not provide excessive information unrelated to your candidacy.
  • When you apply for a specific job position offered by the Management Company, the personal data you provide is processed by the Management Company until the end of the relevant personnel selection process. After the selection process is completed, your personal data will no longer be processed unless you express separate consent for further processing of your personal data for personnel selection purposes.
  • In the event that you send your CV, cover letter or provide other personal data related to your candidacy to the email addresses indicated on our website without an ongoing personnel selection being announced by us, we have the right to store and use such data for up to 1 year during future personnel selections. Please note that you can always withdraw your consent for processing of your personal data by contacting the Management Company (for example, by email to info@xam.lt).

4. Website visits

  • Upon visiting the Management Company’s website www.xam.lt, the Management Company may process the visitor’s IP address as well as other network data (if you provide it). Such data is collected through cookies and/or similar technological solutions on the basis of user consent.
  • Cookies are small files stored on your device when visiting the website. Cookies are used to provide website functionality, improve user experience and analyze usage. The Management Company’s website uses four main types of cookies:
  •  
    • Essential (technical) cookies – necessary for proper website functionality, security and navigation. Their storage is automatic and they cannot be disabled.
    • Analytical cookies – allow us to understand how visitors use the website (pages viewed, time spent, traffic flow). Refusing them does not prevent website functionality, but reduces our ability to monitor its usage.
    • Functional cookies – used to remember your preferences and personalize your experience (for example, language selection).
    • Marketing and engagement cookies – used for form submissions, communication personalization and contact tracking. Your consent is required for these cookies.

  • Some cookies (especially essential and analytical) are necessary for website functionality. If you refuse them, the website may become non-functional or its functionality may be reduced.
  • You can control cookies in your browser settings. More information about cookies and how to manage them can be found at http://www.allaboutcookies.org.

5. Recipients of personal data and other information

  • For processing of your personal data, the Management Company may engage data processors. Such data processors provide various services to the Management Company. These may include companies providing data storage services, postal and communication services, companies developing and maintaining software, companies conducting online business analysis, credit institutions, persons providing audit services, lawyers, companies providing accounting services and other service providers. Your personal data may be provided to these data processors engaged by the Management Company only when and to the extent necessary for provision of their relevant services.
  • In providing services, the Management Company may transfer certain personal data of its clients, their representatives and beneficial owners to other recipients of data, for example, the Bank of Lithuania, the State Tax Inspectorate under the Ministry of Finance of the Republic of Lithuania, the state enterprise Register Center, credit institutions, companies providing accounting services, persons providing audit services, depositary (Swedbank), prime brokers (Interactive Brokers) and other recipients of data.
  • In providing services, the Management Company may transfer certain personal data of its clients (their representatives and/or beneficial owners) to entities controlled by the IISKIS managed by the Management Company, if reasonably necessary for the purposes indicated in this Privacy Policy (for example, to open bank accounts).
  • We ensure that your transferred personal data processors comply (where applicable under legislation) with the instructions and personal data processing instructions provided and implement appropriate organizational and technical measures designed to protect personal data from accidental or unlawful destruction, alteration, disclosure or any other unlawful processing.
  • In accordance with the procedure, cases and grounds established by the Law for the purpose of money laundering and terrorist financing prevention, as well as in accordance with the procedure, cases and grounds established by the International Sanctions Law for the purpose of implementing international sanctions, personal data of the Management Company’s clients, their representatives and/or beneficial owners, as well as personal data of the Management Company’s shareholders, managers, service providers, business partners, intermediaries, their representatives and beneficial owners may be transferred to the Financial Crime Investigation Service under the Ministry of Interior Affairs of the Republic of Lithuania, other law enforcement organizations and financial institutions operating within the EEA and beyond its borders. In all cases, the Management Company makes reasonable efforts to ensure that in implementing the requirements of the Law and the International Sanctions Law, personal data is not lost or unlawfully used.
  • Additionally, we note that consents given regarding personal data processing are stored by the Management Company for the minimum retention period established by the Chief Archivist of Lithuania (1 year after the expiration of the retention period of personal data for which consent to processing was given).

6. Your rights

With regard to your personal data, you have rights provided for in legislation:

Right to be informed about and access your personal data.

You have the right to obtain confirmation from the Management Company that it is processing your personal data, as well as the right to access the personal data being processed and other related information.

Right to correct inaccurate, imprecise or incomplete data.

If you believe that the information about you held by the Management Company is inaccurate or incorrect, you have the right to request that this information be amended, clarified or corrected.

Right to have personal data deleted.

Under certain circumstances provided for in legislation (when personal data is processed unlawfully, the purpose for processing ceases to exist, etc.), you have the right to request that the Management Company delete your personal data.

Right to restrict processing of personal data.

Under certain circumstances provided for in legislation (when personal data is processed unlawfully, you dispute the accuracy of data, etc.), you have the right to request that the Management Company restrict processing of your personal data.

Right to transfer personal data to another data controller or receive directly in a format convenient to you.

Data processed by the Management Company on the basis of your consent and which is processed using automated means, you have the right to receive in commonly used and machine-readable format and you have the right to request that it be transferred to another data controller.

Right to object to processing of your personal data if such data is processed on the basis of legitimate interest.

If personal data is processed on the basis of legitimate interest, you may object to such processing of your personal data, except in cases provided for in legislation (for example, when there are legitimate reasons for such data processing, etc.).

Right to withdraw consent for processing of your personal data at any time (when your personal data is processed on the basis of separate consent).

Once you withdraw your consent to process personal data, processing based on your consent will be terminated.

We remind you that these rights of data subjects are exercised if all requirements set out in legislation are met. You can learn more about your rights as data subjects, conditions for exercising such rights and their specifics at the State Data Protection Inspectorate’s website https://vdai.lrv.lt/ in the section ‘Your Rights’.

To exercise your rights or if you have any questions regarding the protection of your personal data, contact the Management Company using the contact details provided above in this Policy. To enable us to properly examine your request and provide you with a comprehensive answer, please submit your inquiries in writing (by email to info@xam.lt).

If you believe that your rights related to personal data protection are being violated, you have the right to contact the State Data Protection Inspectorate and submit a complaint. In all cases, we recommend you first contact the Management Company so that we can find an appropriate and effective solution to the problem.