Privacy policy
Version 1.0. Effective from [DATE].
This policy explains what personal data we process when you visit [DOMAIN] (the "Website") and when you buy or download teaching materials. We process data in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Lithuanian Law on Legal Protection of Personal Data.
1. Data controller
Asociacija „Kalbų medis“ (Kalbų medis Association) Company code 304875408 Rožių g. 79, Panevėžys, Lithuania Phone +370 612 22258 Email [EMAIL]
We have not appointed a data protection officer. Please send any data protection question to the email address above.
2. What data we collect
| Data | Source |
|---|---|
| Email address | You enter it on the Stripe checkout page |
| Name | You enter it on the Stripe checkout page |
| Country | Stripe checkout page (billing address country) |
| Order data: number, products, amounts, discount, date, payment status, Stripe payment ID | Website and Stripe |
| Download data: how many times a file was downloaded, link expiry | Website |
| Consent records: which boxes you ticked, the text version, time, browser information (user agent), a hash of your IP address | Website, when you place an order |
| IP address hash for rate limiting | Website, when you download free materials or place an order |
| Analytics cookies and browsing statistics | Google Analytics 4, only if you consent |
| Correspondence | You, when you email us |
An IP address hash is an encoded value derived from your IP address. We do not store your full IP address in our database.
We do not receive your card details. Stripe handles them.
You can download free materials without giving an email address.
3. Why we process data and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Fulfilling your order: payment, sending download links, resending links, order support | Email, name, country, order and download data | (b) performance of a contract |
| Accounting | Order data, name, country | (c) legal obligation |
| Proof that you accepted the Terms and lost the right of withdrawal for digital content | Consent records | (c) legal obligation and (f) legitimate interest in defending legal claims |
| Website security and abuse prevention | IP address hash | (f) legitimate interest in protecting the Website |
| Replying to your emails and complaints | Correspondence, order data | (b) performance of a contract or (f) legitimate interest in answering you |
| Visitor statistics | Analytics cookies | (a) your consent |
| Investigating licence breaches | Order and download data | (f) legitimate interest in protecting copyright |
We do not send marketing emails. We do not make automated decisions that have legal effects on you.
4. Who processes data on our behalf
We use the following service providers. Data processing agreements are in place with them (the providers' standard terms).
| Provider | What it does | Where data is processed |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd., Ireland) | Payment processing, receipts | EU; possible transfer to the US |
| Supabase (Supabase Inc.) | Database and file storage | EU (Frankfurt, Germany) |
| Resend (Resend Inc.) | Sending emails | US |
| Vercel (Vercel Inc.) | Website hosting | EU (Frankfurt); company registered in the US |
| Google Analytics 4 (Google Ireland Ltd.) | Visitor statistics, only with your consent | EU; possible transfer to the US |
| Cloudflare R2 (Cloudflare Inc.) | Encrypted database backups | [R2 LOCATION, TO CONFIRM: EU jurisdiction] |
For some purposes, such as fraud prevention and financial reporting, Stripe processes data as an independent controller. More information: https://stripe.com/privacy.
We may also disclose data to public authorities where the law requires it.
5. Transfers outside the EU
Some providers are US companies or may transfer data to the US. These transfers rely on the EU-US Data Privacy Framework where the company is certified, or on Standard Contractual Clauses approved by the European Commission. Copies are available on the providers' websites or on request.
6. How long we keep data
| Data | Retention period |
|---|---|
| Orders and related accounting data | [10 YEARS, CONFIRM WITH ACCOUNTANT] from the order |
| Consent records | Same as the order |
| Download links | Valid for 30 days; the record of the link is kept with the order |
| IP address hash for rate limiting | Up to 30 days |
| Correspondence | Up to 3 years from the last email if not related to an order; otherwise kept with the order |
| Google Analytics data | 2 months (Google Analytics setting) |
| Backups | 35 days, then deleted automatically |
When the period ends, data is deleted or anonymised. Deleted data disappears from backups within 35 days.
7. Your rights
You have the right to:
- know what data we hold about you and get a copy;
- ask us to correct inaccurate data;
- ask us to delete data when it is no longer needed or is processed without a legal basis (we cannot delete accounting data before the legal retention period ends);
- ask us to restrict processing;
- receive the data you gave us in a structured format and pass it to another controller;
- object to processing based on legitimate interest;
- withdraw your consent to analytics cookies at any time. Withdrawal does not affect earlier processing.
Send your request to [EMAIL]. We may ask you to confirm your identity, for example by writing from the email address used for the order. We will reply within 1 month. For complex requests we may extend this by 2 more months and will tell you if we do.
8. Cookies
The Website uses necessary cookies and, only with your consent, analytics cookies. On your first visit a cookie banner lets you accept or reject them. You can change your choice at any time with the "Cookie settings" link at the bottom of the Website.
| Cookie | Purpose | Type | Expiry |
|---|---|---|---|
cc_cookie |
Remembers your cookie choice | Necessary | 6 months |
NEXT_LOCALE |
Remembers your chosen language | Necessary | [TO CONFIRM WITH DEVELOPER] |
_ga |
Google Analytics: distinguishes visitors | Analytics, consent only | 2 years |
_ga_[ID] |
Google Analytics: keeps session state | Analytics, consent only | 2 years |
Your cart is stored in your browser's local storage (localStorage) and is not sent to our servers until you place an order.
On the Stripe checkout page, Stripe uses its own cookies for payment security. Stripe's privacy policy applies to them.
9. Security
Data is sent over an encrypted connection (HTTPS). Access to the admin system is protected by a password and two-factor authentication. Paid files are kept in private storage and are downloaded through short-lived links. Backups are encrypted.
10. Complaints
If you think your data is processed unlawfully, please email us first at [EMAIL]. You also have the right to complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI): L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, vdai.lrv.lt. If you live in another EU country, you can also complain to the data protection authority there.
11. Changes
We may update this policy. The new version is published on the Website with a new effective date.