Privacy policy

Effective Date: 28 August 2026
Dacument version: 1.0

1. Introduction and Scope

Source is the operational brand of coretech lt, UAB (hereinafter referred to as “Source ”, the “Company”, “we”, “us”, or “our”), a private limited liability company registered in the Republic of Lithuania.

Source exists to support and empower a diverse ecosystem of independently operated portfolio companies by providing a strong backbone of shared principles and smart operations. Our core functions include Legal, Finance, Human Resources, Revenue Operations (RevOps), Risk Management, Information Security, IT, Communications, Data & Analytics, and centralized Procurement.

This Privacy Policy explains how Source collects, uses, stores, shares, and otherwise processes your personal data in connection with:

• your use of the Source website (Source.ai) or such other domain as we may operate);
• your contact or interactions with Source, including emails, inquiry forms, or any other communication methods;
• our business relationships with partners, vendors, and service providers;
• our employer branding activities, including career pages, social media channels, partnerships, and affiliate programs;
• your visits to Source premises, which are equipped with CCTV surveillance;
• acquisition-related activities within our key business segments.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, hereinafter - the “GDPR”), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable data protection legislation.

Note regarding job applicants: If you are a candidate applying for a position at Source or any of its portfolio companies, a separate Recruitment Privacy Notice governs the processing of your personal data and is provided during the application process.

2. Data Controller

The data controller responsible for the processing of your personal data described in this Privacy Policy is:

coretech lt, UAB
Registered address: Švitrigailos g. 32, LT-03230 Vilnius
Company registration number: 304953472
Email: [email protected]

For any questions about how we process your personal data, or to exercise your data subject rights, please contact:

Email: [email protected]

3. The Source Ecosystem and Group Structure

Source serves as the centralized operational core for a group of independently run portfolio companies (the “Source Ecosystem” or “Group”). Each portfolio company operates with full ownership of its products, teams, and go-to-market strategies, while Source provides shared back-office functions, governance frameworks, and centralized procurement.

In the context of this Privacy Policy, it is important to understand that:

• Source as controller: For the processing activities described in this Privacy Policy (the Source website, employer branding, CCTV on Source premises, centralized procurement, and corporate functions), coretech lt, UAB is the data controller.
• Portfolio companies as separate controllers: Each portfolio company within the Source Ecosystem is a separate data controller for its own processing activities. This Privacy Policy does not cover personal data processing carried out independently by individual portfolio companies under their own privacy policies.
• Intra-group data sharing: In providing centralized services (e.g., Legal, HR, Finance, Risk, Information Security), Source may receive and process limited personal data from portfolio companies or share data with them. Such intra-group transfers are governed by appropriate data sharing agreements.
• Acquisitions: Source is actively engaged in identifying and acquiring high-potential ventures aligned with Source values. In the context of potential acquisitions, limited personal data (such as contact details of key personnel, financial data, and governance information) may be processed for due diligence purposes on the basis of our legitimate interest in evaluating potential business opportunities.

4. Who This Policy Applies To

This Privacy Policy applies to the following categories of data subjects:

• Website visitors – individuals who access and browse the Source website;
• Contact persons and inquirers – individuals who contact Source through the website, email, phone, or other communication channels;
• Business partners, vendors, and service providers – representatives of entities with whom Source collaborates, or who provide products and services to the Company and its ecosystem (including centralized procurement counterparties);
• Employer branding audience – individuals who interact with Source’s employer branding content on social media channels, career web pages, partnership programs, or affiliate platforms;
• Visitors to Source premises – individuals who enter areas monitored by CCTV;
• Acquisition targets and their representatives – key personnel and contact persons of companies being evaluated for potential acquisition into the Source Ecosystem.

5. Categories of Personal Data We Collect

5.1. Website Visitors

• IP address and approximate geolocation derived therefrom
• Browser type and version, operating system, device identifiers
• Pages visited, time and date of access, referring URL, click behavior, and session duration
• Cookie identifiers and similar tracking technologies (see Section 12 below)
• Any personal data you voluntarily provide through contact forms or email inquiries (e.g., name, email address, phone number, message content)

5.2. Business Partners, Vendors, and Service Providers (incl. Procurement)

• Full name, job title, and professional role
• Business contact details (email address, telephone number, business address)
• Company name, registration number, and relevant company details
• Financial and billing information (e.g., bank account details, VAT number) necessary for contract performance and centralized procurement processes
• Communication records and correspondence
• Compliance and due diligence information (e.g., sanctions screening data, compliance checks)

5.3. Employer Branding Activities

• Name, email address, and social media handles of individuals who engage with Source’s employer branding content, career pages, or affiliate programs
• Event registration data (name, email, company, role) for employer branding events, webinars, or partnership activities
• Interaction data from social media platforms (e.g., likes, shares, comments) to the extent made publicly available by the individual and collected in accordance with platform-specific terms
• Referral data provided by employees, affiliates, or partners in the context of talent referral programs

5.4. Visitors to Source Premises (CCTV)

• Video images and recordings captured by CCTV cameras installed on and around Source premises
• Date, time, and location of recording
• Visitor log information (name, company, purpose of visit, time of entry and exit)

5.5. Acquisition-Related Data

• Names, job titles, and contact details of key personnel at target companies
• Financial, organizational, and governance information relevant to the due diligence process
• Publicly available professional data (e.g., from company registries, LinkedIn, professional directories)

6. Purposes of Processing and Legal Bases

We process personal data only where we have a lawful basis under Article 6(1) GDPR. The table below summarizes our processing activities, associated data categories, and legal bases:

7. CCTV Video Surveillance

Source operates CCTV cameras on its premises for the purpose of safeguarding the security and safety of its property, assets, employees, and visitors. The use of CCTV is based on our legitimate interest in maintaining a safe and secure working environment (Article 6(1)(f) GDPR).

7.1. Scope and Purpose

CCTV cameras are installed in designated areas of Source premises, including entrances, exits, reception areas, corridors, parking areas, and other common areas. Cameras are not installed in areas where individuals have a heightened expectation of privacy, such as restrooms, changing rooms, or private offices.

CCTV footage is used exclusively for:

• Protection of Company property and assets
• Ensuring the health and safety of employees, visitors, and contractors
• Prevention and detection of criminal activity
• Support of investigations into incidents, accidents, or security breaches
• Compliance with legal or regulatory obligations where applicable

CCTV footage will not be used for any purpose other than those stated above.

7.2. Signage and Transparency

Clear and visible signage is displayed at all entry points to areas monitored by CCTV. Each sign includes the identity of the data controller, the purpose of surveillance, contact details for further information.

7.3. Access and Retention

Access to CCTV footage is strictly limited to authorized personnel with a need to access such footage (e.g., designated security, administration team, IT, and management staff).

CCTV footage is retained for a maximum period of 30 days, unless a longer retention is required in connection with an ongoing investigation, security incident, or legal proceedings. Footage is automatically overwritten or securely deleted after the retention period expires.

7.4. Sharing of CCTV Footage

CCTV footage may be disclosed to law enforcement authorities in connection with the investigation or prevention of criminal offences, and to insurers in connection with claims, as permitted by applicable law. When footage is shared in response to a data subject access request, the identities of other individuals captured in the footage will be redacted to protect their privacy.

8. Employer Branding and Career Activities

Source is the central hub for employer branding activities across the Source Ecosystem. This includes managing social media channels, career website, partnership programs, and affiliate platforms dedicated to creating a transparent, diverse employer brand that represents the culture and people behind each portfolio company’s product.

In the context of employer branding, we may process personal data in the following ways:

• Social media: We operate employer branding profiles on social media platforms (e.g., LinkedIn, Instagram, Facebook). If you interact with our content (likes, comments, shares), we may process your publicly available profile data in accordance with the respective platform’s terms. We do not create profiles of individuals based on their social media activity.
• Career pages and job postings: Our career web pages may collect basic contact information (name, email) when you subscribe to job alerts or express interest. The actual processing of candidate data is governed by our separate Recruitment Privacy Notice.
• Partnerships and affiliates: Where we cooperate with partner organizations or affiliates for employer branding purposes (e.g., university partnerships, employer review platforms, recruitment agencies), we may receive and process contact data of representatives of such organizations.
• Events and webinars: If you register for employer branding events, webinars, or informational sessions hosted or co-hosted by Source, we will process your registration data (name, email, company, role) for event organization purposes.

Where employer branding activities involve the use of cookies or tracking technologies on our career pages or website, Section 12 of this Privacy Policy applies.

9. Sources of Personal Data

We may obtain personal data from the following sources:

• Directly from you: when you visit our website, submit a contact form, send an email, call our employees, visit our premises, subscribe to career alerts, register for events, or otherwise interact with us;
• From your employer or organization: when your contact details are provided to us in the context of a business, vendor, or procurement relationship between your organization and Source or a portfolio company;
• From portfolio companies within the Source Ecosystem: in connection with the provision of centralized back-office services (e.g., HR, Legal, Finance, Risk);
• From publicly available sources: such as company registries (e.g., the Lithuanian Register of Legal Entities), public professional directories, and professional networking platforms, particularly in the context of acquisition due diligence or business development;
• Automatically through our website: via cookies, server logs, and similar technologies when you access our website (see Section 12);
• From social media platforms: publicly available interaction data resulting from your engagement with our employer branding content.

10. Recipients of Personal Data

We do not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, solely to the extent necessary for the purposes described in this Privacy Policy:

• Source Ecosystem entities: portfolio companies within the Source group, for the purpose of providing centralized back-office services, governance, employer branding, and procurement functions. Each portfolio company receiving data acts in accordance with applicable data protection requirements and intra-group data sharing agreements;
• Service providers and data processors: third-party providers who process data on our behalf, including IT hosting and infrastructure providers, cloud service providers, website analytics providers, social media management tools, employer branding platforms, and professional advisors. All processors are bound by data processing agreements in accordance with Article 28 GDPR;
• Centralized procurement counterparties: vendors and suppliers engaged through Source’s centralized procurement process (e.g., proxy infrastructure providers, software tool vendors, data center service providers), to the extent personal data of contact persons is required for contract management;
• Professional advisors: external lawyers, auditors, tax advisors, accountants, insurance providers, and consultants engaged for Source’s operations, compliance, or acquisition activities;
• Public authorities and regulators: where required by law, court order, or regulatory request (e.g., Lithuanian tax authorities (VMI), the State Data Protection Inspectorate (VDAI), law enforcement, or other competent authorities);
• Potential acquirers or targets: in the context of mergers, acquisitions, or corporate restructuring, personal data may be disclosed to potential acquirers, their advisors, or target company representatives, subject to appropriate confidentiality obligations and in compliance with applicable data protection law.

11. International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). Where we transfer personal data outside the EEA - for example, in connection with the use of cloud service providers, analytics tools, or cooperation with portfolio companies or procurement counterparties located outside the EEA - we ensure that an adequate level of protection is provided in accordance with Chapter V of the GDPR by relying on one or more of the following safeguards:

• Adequacy decisions: the European Commission has determined that the recipient country or framework provides an adequate level of data protection (e.g., the EU–U.S. Data Privacy Framework for DPF-certified U.S. entities);
• Standard Contractual Clauses (SCCs): we enter into the European Commission’s approved Standard Contractual Clauses (Implementing Decision (EU) 2021/914, as updated) with data recipients, supplemented by additional technical and organizational safeguards where necessary;
• Binding Corporate Rules (BCRs): where applicable, intra-group transfers may be governed by approved Binding Corporate Rules;
• Derogations under Article 49 GDPR: in exceptional circumstances and only where no other transfer mechanism is available, we may rely on specific derogations (e.g., your explicit consent, necessity for contract performance).

12. Cookies and Similar Technologies

12.1. What Are Cookies

Cookies are small text files placed on your device when you visit our website. They allow our website to recognize your device, remember your preferences, and collect information about your browsing activity. Similar technologies such as pixels, web beacons, and local storage may also be used.

12.2. Types of Cookies We Use

• Strictly necessary cookies: Essential for basic website operation (security, network management, accessibility). These cannot be disabled and do not require consent.
• Analytics / performance cookies: Collect anonymous, aggregated data about how visitors use the website (e.g., pages visited, navigation paths). These help us improve functionality and performance. Set only with your consent.
• Functional cookies: Enable enhanced functionality and personalization (e.g., language preference, region). May be set by us or by third-party service providers integrated into our pages. Set only with your consent.
• Marketing / targeting cookies: May be used to track visitors across websites and display relevant advertisements, including for employer branding purposes. Set only with your explicit consent.

12.3. Cookie Consent and Management

When you first visit the Source website, a cookie consent banner is displayed, allowing you to accept or reject non-essential cookies. You may change or withdraw your cookie preferences at any time by:

• Clicking the cookie settings link in the website footer;
• Adjusting your browser settings to block or delete cookies;

Important: We ensure that the option to reject cookies is equally prominent and accessible as the option to accept, in compliance with current EDPB guidance and the proposed EU Digital Fairness Omnibus requirements on dark patterns in consent interfaces. Rejecting non-essential cookies will not affect the basic functionality of the website.

12.4. Cookie Schedule

13. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Lithuanian and EU law. The following table provides indicative retention periods:

Once the applicable retention period expires, personal data is securely deleted or anonymized. Longer retention may apply where required by Lithuanian or EU law (e.g., tax records under Lithuanian accounting legislation must be retained for 10 years) or to establish, exercise, or defend legal claims under applicable limitation periods.

14. Your Rights as a Data Subject

Under the GDPR and the Lithuanian Law on Legal Protection of Personal Data, you have the following rights in relation to your personal data. You may exercise any of these rights free of charge by contacting us at the details provided in Section 2:

• Right of access (Article 15 GDPR): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to obtain a copy of such data together with information about the processing (purposes, categories of data, recipients, retention periods, and your rights).
• Right to rectification (Article 16 GDPR): You have the right to request the correction of inaccurate personal data or the completion of incomplete data.
• Right to erasure (Article 17 GDPR): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, where the data has been unlawfully processed, or on other applicable grounds.
• Right to restriction of processing (Article 18 GDPR): You have the right to request the restriction of processing in certain circumstances, for example while we verify the accuracy of your data or assess whether our legitimate interests override yours.
• Right to data portability (Article 20 GDPR): Where processing is based on consent or contract performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object (Article 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interest at any time, on grounds relating to your particular situation. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for legal claims.
• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent (e.g., non-essential cookies, certain employer branding communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right not to be subject to automated decision-making (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. Source does not currently engage in solely automated decision-making processes that produce legal or similarly significant effects.

How to exercise your rights: Please send your request at the contact details in Section 2. We will respond within one (1) month of receipt. This period may be extended by a further two (2) months where necessary given the complexity and number of requests. We will inform you of any extension within one month, together with the reasons for the delay. We may request verification of your identity before fulfilling your request.

If your request is manifestly unfounded or excessive (in particular by virtue of its repetitive character), we may charge a reasonable administrative fee or refuse to act on the request, as permitted by Article 12(5) GDPR.

15. Data Security

In accordance with Article 32 of the GDPR, Source implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing. Given Source’s Information Security function serves the entire ecosystem, our security measures include:

• Encryption of personal data in transit (TLS/SSL) and at rest where appropriate;
• Access controls, multi-factor authentication, and role-based access control to restrict access to personal data on a need-to-know basis and least privilege principle;
• Regular security assessments, vulnerability scanning, and penetration testing;
• Mandatory logging enabled across Source systems and applications to systematically collect and centralize security event logs from all critical systems;
• Employee training and awareness programs on data protection and information security
• Incident response and data breach notification procedures
• Physical security measures for Source premises and IT infrastructure (including CCTV)
• Business continuity and disaster recovery capabilities, including regular backups with secure, tested backup recovery procedures;
• Supply chain security assessments for third-party vendors and procurement counterparties.

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, we will notify the State Data Protection Inspectorate (VDAI) within 72 hours and, where required, inform affected data subjects without undue delay.

16. Children’s Data

The Source website and services are not directed at children under the age of 16. We do not knowingly collect or process personal data from children. If we become aware that personal data has been inadvertently collected from a child, we will take steps to delete such data promptly. If you believe a child’s personal data has been provided to us, please contact us immediately.

17. Links to Third-Party Websites and Platforms

The Source website may contain links to external websites, including the websites of our portfolio companies, social media platforms, employer branding platforms, and other third-party services. Each portfolio company within the Source Ecosystem maintains its own privacy policy governing the processing of personal data on its respective platforms.

We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any website you visit via links from our site. The inclusion of a link does not imply endorsement of the linked website by Source.

18. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR or applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI)
Phone: +370 5 271 2804 / +370 5 279 1445
Email: [email protected]
Website: https://vdai.lrv.lt

You may also lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence or place of work, if different from Lithuania.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority. Please do not hesitate to contact in the first instance.

19. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, the structure of the Source Ecosystem, applicable legal requirements, or regulatory guidance. The current version of this Privacy Policy will always be published on our website with an updated effective date.

Where changes materially affect the way we process your personal data or alter your rights, we will take reasonable steps to notify you in advance (e.g., by placing a prominent notice on our website or, where appropriate, by email). We recommend reviewing this Privacy Policy periodically, and at minimum upon each visit to our website.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at: [email protected].