Privacy Policy

1. Data we collect

• Enquiries: name, email address, optional phone number, message, submission time and a one-way IP-address hash used to prevent abuse.
• Accounts: name, email address, secure password hash, verification and recovery data, sessions and security audit records.
• Technical data: request time, browser and device information and an IP address where necessary for communication, server security and error diagnostics.
• Google Analytics 4, only after consent: page views, interactions, session statistics, approximate location, browser, device and referrer information. We do not send contact-form contents to Analytics.

2. Purposes and legal bases

• To answer an enquiry, prepare a quotation and take pre-contractual steps — GDPR Article 6(1)(b).
• To provide account, project and maintenance functions and perform a contract — GDPR Article 6(1)(b).
• To secure the site, prevent spam and diagnose faults — legitimate interests under GDPR Article 6(1)(f).
• To measure usage with Google Analytics — your consent under GDPR Article 6(1)(a), which you may withdraw at any time.
• To meet accounting and other legal obligations — GDPR Article 6(1)(c).

3. Recipients and international transfers

Data is disclosed only to providers needed to operate the site and communications: hosting and database infrastructure, Brevo for email delivery, Telegram for contact-form notifications and, only with consent, Google Analytics.

Where a provider or sub-processor operates outside the EEA, transfers rely on an applicable European Commission adequacy decision, Standard Contractual Clauses or another lawful safeguard. We do not sell personal data or provide it to third parties for their direct marketing.

4. Retention

• Enquiries: up to 2 years after the last contact, or longer where a contract and legal retention duties apply.
• Account data: while the account is active; necessary security and audit records are normally retained for no more than 2 years after closure.
• Server and security logs: normally up to 12 months, unless an incident requires longer investigation.
• Google Analytics user- and event-level data: under the GA4 setting, no longer than 14 months; aggregated reports may remain longer.

5. Your rights

You may request access, correction, erasure, restriction, object to processing based on legitimate interests and, where applicable, data portability. You can withdraw analytics consent in Cookie settings without affecting earlier lawful processing.

Email requests to viktor@sitestudio.lt. We respond within the period required by the GDPR. You may also complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or your local supervisory authority.

6. Security and changes

We use HTTPS, restricted access, password hashing, database access controls, backups and technical safeguards. No transmission or storage method is completely risk-free.

We update this policy when the site, providers or legal requirements change. The current version and update date are always published here.