BDAR / GDPR

Privacy Policy

This privacy policy explains what personal data IT Profai processes, for which purposes and legal grounds, how long it is kept, and what rights you have under the General Data Protection Regulation (GDPR).

Last updated: 2026-09-29

1. Data controller

IT Profai — individual activity carried out under Lithuanian individual activity certificate FR0468 No. 1536573 (Republic of Lithuania).

Contact for all data protection matters: info@itprofai.lt, phone +370 659 93999.

2. Data we collect

We only collect data needed to deliver the service or answer your enquiry:

  • Call booking: name, phone number, email address, selected consultation topic, the problem you describe, and the chosen date and time.
  • Correspondence and calls: contact details and the content of the enquiry you send by email or discuss by phone.
  • The ITProfas AI assistant: the messages you write, sent to generate a reply. The conversation history is stored only in your browser — not in our database.
  • Technical data: IP address and information provided by your browser, processed temporarily for site operation and security; only the country is derived from the network header so we can politely suggest a suitable site language.

3. Purposes and legal grounds

We process personal data under Article 6 of the GDPR:

  • Booking and delivering a consultation — performance of a contract or pre-contractual steps (Art. 6(1)(b)).
  • Answering enquiries and preparing proposals — steps taken at your request and our legitimate interest in communicating with clients (Art. 6(1)(b) and (f)).
  • Site operation, security and troubleshooting — legitimate interest in providing a secure service (Art. 6(1)(f)).
  • Accounting and tax duties where a service is paid for — legal obligation (Art. 6(1)(c)).

4. Retention periods

Booking and correspondence data are kept for up to 2 years after the last contact so we can continue ongoing work and answer follow-up questions. Accounting records are kept for 10 years as required by Lithuanian law. You can delete the AI assistant conversation at any time by clearing your browser data or starting a new conversation.

5. Recipients

We never sell your data or share it for advertising. Data is processed only by trusted providers acting on our instructions: website and database hosting, email delivery, and AI response generation. Data processing agreements are in place, and any transfer outside the European Economic Area happens only with appropriate safeguards (for example the European Commission's Standard Contractual Clauses).

6. Cookies and local storage

We use no advertising or visitor-tracking cookies — there is no Google Analytics, Facebook Pixel or similar tracking. We only use technical storage required for the site to work: the sign-in session in the admin area, your language choice, and the AI assistant conversation kept in your browser. You can delete these values at any time in your browser settings.

7. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy;
  • have inaccurate data corrected;
  • have data erased (the 'right to be forgotten') when it is no longer needed;
  • restrict processing or object to processing based on legitimate interest;
  • receive your data in a portable format;
  • withdraw consent where processing is based on consent.

8. Exercising your rights and complaints

To exercise any right, email info@itprofai.lt — we reply within one month at the latest. If you believe your data is processed unlawfully, you may lodge a complaint with the Lithuanian State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, ada@ada.lt, vdai.lrv.lt) or with your local supervisory authority.

9. Security and changes to this policy

Data is transmitted over an encrypted connection (HTTPS), access is limited to the owner, and the admin area is protected by sign-in. If this policy is updated, the new version is published on this page and the update date is changed.

10. Minors

Our services are intended for business clients and adults. We do not knowingly collect data from persons under 16; if we learn of such data, we delete it without delay.

Data protection contact