Privacy policy

In the newsletter and early-access form we store only your e-mail address, the fact that you consented, the page you signed up from and the time of sign-up. Nothing else. We use this data only for Privacio news and to tell you when you can try the tool.

In the waitlist form we keep your email address, the plan you chose, your organisation's name and employee band (if you give them), the fact of consent, the page and the time. We use them only to invite you to Privacio and offer the plan you chose. We keep them until we invite you, and no longer than 12 months.

When you request a record sample, we store your e-mail address, the sector you chose, whether you ticked the news box, the page you asked from, and the time of the request. We use them for two purposes: to give you the sample and to contact you about Privacio services, by calling your organisation or sending an offer by e-mail. We send news based on this request only if you ticked the separate news box.

If you write to us by e-mail, we process your e-mail address and the content of your message so that we can reply. The website does not use cookies, third-party analytics or tracking technologies.

We send news only with your consent. You can withdraw it at any time by writing to the e-mail address above. We keep the sign-up data until you withdraw your consent. We handle a sample request on the basis of our legitimate interest in giving the sample to the person who asked for it and offering our services (GDPR Article 6(1)(f)). You can object to being contacted about our services at any time. We keep the request for 1 year or until you ask us to delete it; older requests are deleted automatically. When you withdraw consent or ask us to delete the data, we delete your entry completely.

We keep an e-mail enquiry only as long as needed to handle it, reply and, where necessary, establish or defend a legal claim. When that purpose ends, we delete the data.

Newsletter and waitlist sign-ups and record sample requests are stored on a server in the Amazon Web Services (AWS) cloud, in region eu-central-1 (Frankfurt, Germany, inside the European Economic Area). CBRX administers this server on behalf of Privacio.

The website is delivered through Amazon CloudFront, the AWS content delivery network. We do not keep website access logs, and the sign-up service does not write e-mail addresses to logs. If a request to the server fails (for example, while it restarts), the visitor's IP address stays in the server error log, which is deleted after 30 days. We do this on the basis of our legitimate interest in keeping the website working and secure (GDPR Article 6(1)(f)).

To count website visits we use our own cookie-free counter. It stores only the day, the page, the referring website's domain and the number of views, without IP addresses or browser details. More in the cookie policy.

We do not sell the data or use it for other companies' advertising. Only these service providers process it, acting on our instructions: CBRX (administration of the website and the sign-up service), AWS (server and content delivery), the e-mail service provider and Google Ireland Limited (Google Fonts delivery; receives the visitor's IP address and browser details. Any transfer outside the EEA relies on a transfer basis provided for in the GDPR). If providing a service meant a transfer outside the European Economic Area, a transfer basis and safeguards provided for in the GDPR would apply first.

You can ask to access your data, correct it, delete it or restrict its processing. Where applicable, you can receive the data you provided in a common machine-readable format and pass it to another controller, and you can object to the processing.

• Article 15: right of access to your data.
• Articles 16–18: right to rectification, erasure or restriction of processing.
• Articles 20–21: right to data portability and right to object.
• Article 22: right not to be subject to a significant decision based solely on automated processing.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can also lodge a complaint with the State Data Protection Inspectorate (VDAI). The text of your rights is in the official GDPR text.

Write to justinas.jurkonis@linden.lt and say clearly which right you are exercising. We may ask for information needed to confirm your identity, but we will not ask for more data than needed to fulfil the request. We will reply to the request as the GDPR requires.