Privacy policy | Visuotinė gynyba

Last updated: 2026-08-28

1. Who processes your data

The controller of your personal data is the association VISUOTINĖ GYNYBA.

Legal entity code: 308006727
Address: Žalgirio g. 90, LT-09303 Vilnius, Republic of Lithuania
Email: info@visuotinegynyba.lt
Telephone: +370 698 44016

This policy explains what personal data we collect on this website, why we collect it, how long we keep it, who we share it with, and what rights you have.

We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

2. What data we process, and why

2.1. Donations

Data processed: name, email address, organisation name (if you give one), the donation amount and currency, the frequency (one-off or monthly), the donor type, the payment method and status, the transaction identifiers assigned by the payment service provider, the consents you ticked and their date. For donations by bank transfer — the payer details received from the bank.

We neither see nor store payment card details. The payment is carried out by the payment service provider in its own environment; all we learn is whether the payment succeeded, and the data listed above.

Purpose: to accept and account for the donation, send a document confirming it, administer monthly donations, and meet accounting and reporting obligations.

Legal basis: GDPR Art. 6(1)(b) (performance of a contract) and Art. 6(1)(c) (legal obligation — bookkeeping and the reporting duties of a recipient of donations).

Retention period: data held in accounting records — 10 years from the transaction, as required by the legislation governing accounting and record retention. Records of failed or incomplete payments — 12 months.

2.2. Allocating 1.2% of personal income tax

If you allocate a share of your personal income tax to us, we receive your name and the amount allocated from the State Tax Inspectorate rather than directly from you.

Purpose: to accept and account for the funds allocated.

Legal basis: GDPR Art. 6(1)(c) (legal obligation).

Retention period: 10 years, in line with the retention periods for accounting records.

2.3. Organisation Charter applications

Data processed: the organisation’s name, the contact person’s name, email address and telephone number, your message, and the status of the application.

Purpose: to assess the application, contact you and administer the Charter signing process.

Legal basis: GDPR Art. 6(1)(b) (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest in keeping in touch with the organisation’s contact person).

Retention period: once the Charter is signed — for as long as it is in force and for 5 years afterwards; rejected or unanswered applications — 2 years from the last correspondence.

2.4. Sponsorship applications

Data processed: company name, company code, VAT number, address, the contact person’s name, email address and telephone number, the intended donation amount, a message, and the status of the application.

Purpose: to negotiate and administer a donation agreement.

Legal basis: GDPR Art. 6(1)(b) and Art. 6(1)(f) (legitimate interest in communicating with the company’s contact person).

Retention period: where an agreement was concluded — 10 years, in line with the retention periods for accounting records; where none was concluded — 2 years from the last correspondence.

2.5. Enquiries made through website forms

Data processed: the ones you enter in the form — usually your name, email address, telephone number and the text of your message.

Purpose: to answer your enquiry.

Legal basis: GDPR Art. 6(1)(f) (legitimate interest in replying to an enquiry addressed to us).

Retention period: 2 years from the end of the correspondence.

2.6. Newsletter

Data processed: email address, name, the fact that consent was given, and the date.

Purpose: to send the association’s news.

Legal basis: GDPR Art. 6(1)(a) (your consent). Consent is voluntary — a donation is accepted whether or not it is given.

Retention period: until consent is withdrawn. You can withdraw consent at any time using the unsubscribe link in every message, or by writing to info@visuotinegynyba.lt. We keep a record of the withdrawal and its date for a further 2 years, so that we can demonstrate that consent was properly withdrawn.

2.7. Experts and individuals featured on the website

Data processed: name, position, organisation, photograph, biography, quotations, video, and other information provided or publicly available.

Purpose: to introduce the association’s experts, authors and contributors.

Legal basis: GDPR Art. 6(1)(a) (the individual’s consent) or Art. 6(1)(f) (legitimate interest in presenting our work and those involved in it publicly). Photographs and video are published only with the individual’s consent.

Retention period: for as long as the person is connected with the association’s work, or until consent is withdrawn or an objection is made.

2.8. Website administration and technical records

Data processed: content administrators’ email addresses, encrypted passwords, sign-in times and the content changes they made; in server logs — the IP address, the time and address of the request, the browser type, and error messages.

Purpose: to administer the website’s content and to ensure that it works and is secure, and to investigate incidents.

Legal basis: GDPR Art. 6(1)(f) (legitimate interest in managing and protecting our information system).

Retention period: administrator account data — for as long as the account is valid and for 12 months after it is deleted; server logs — 30 days, unless a log is needed to investigate an incident.

3. Where we obtain data from

We receive most data directly from you — when you fill in a form, donate or write to us. What we do not receive from you:

data about the allocation of 1.2% of personal income tax — from the State Tax Inspectorate;
payment confirmation data — from the payment service provider and the bank;
publicly available information about experts — from public sources or from the organisations they represent.

4. Who we share data with

We do not sell personal data or pass it to third parties for marketing purposes. Data may be received by:

Stripe Payments Europe, Ltd. (Ireland) — payment data, so that the payment can be processed;
Resend, Inc. (United States) — the email address and the contents of the message, so that the message can be sent;
Google Ireland Limited (“YouTube”) — your IP address and browser data, but only if you play a video embedded on an expert page yourself. If you open the page and do not play the video, no data is transmitted;
our website hosting provider — the data held on the website;
our bookkeeping service provider — donation and accounting data;
The State Tax Inspectorate — reports on donations received and used, in the manner and to the extent prescribed by law;
law enforcement and supervisory authorities, courts and bailiffs — where required by law or in defending legal claims;
lawyers and auditors — where legal assistance or an audit is required.

We have entered into data processing agreements with our processors under Article 28 of the GDPR.

5. Transfers of data outside the European Economic Area

In using an email delivery service we transfer data to the United States. The transfer is based on the standard contractual clauses approved by the European Commission and/or the EU–US Data Privacy Framework. We transfer no other data outside the EEA. You can obtain copies of the agreements by writing to info@visuotinegynyba.lt.

6. Cookies

We use no analytics, advertising or social network tracking cookies on the website. The only measures we use ourselves are strictly necessary ones:

the sign-in cookie — created only when a website administrator signs in to the content management system; it is never created for an ordinary visitor;
the light or dark theme preference is held in the browser’s storage — it is written only when you choose a theme yourself, and it is never transmitted anywhere.

Because these measures are necessary to provide the service you have explicitly requested, we do not ask for consent to them (Article 69 of the Law on Electronic Communications of the Republic of Lithuania). If we were to start using analytics or marketing cookies in future, we would ask for your consent first.

Separately: YouTube videos embedded on the expert pages. They load nothing and transmit nothing until you press the play button yourself; once you do, Google writes cookies.

More — cookie policy.

7. Your rights

You have the right to:

know that your personal data is being processed;
access the data we process and obtain a copy of it (GDPR Art. 15);
have inaccurate data corrected or incomplete data completed (Art. 16);
have data erased where there are grounds for it (Art. 17);
restrict processing (Art. 18);
receive your data in a structured, machine-readable format and have it ported (Art. 20);
object to processing based on legitimate interest (Art. 21);
withdraw consent at any time — this does not affect the lawfulness of processing carried out before it was withdrawn;
object to direct marketing messages at any time and without giving reasons.

Some rights are not absolute. For example, we cannot erase donation data that we are required to retain for accounting purposes until the retention period set by law has expired.

How to use it: write to info@visuotinegynyba.lt or send a request to Žalgirio g. 90, LT-09303 Vilnius. To act on a request we will need to satisfy ourselves as to your identity. We reply within one month at the latest; in complex cases the period may be extended by a further two months, and we will tell you if it is. Requests are handled free of charge.

8. Complaints

If you believe we are processing your data unlawfully, please contact us first — we will try to resolve the matter. You also have the right to lodge a complaint with the supervisory authority:

The State Data Protection Inspectorate
L. Sapiegos g. 17, LT-10312 Vilnius
Tel. +370 5 271 2804, email ada@ada.lt
vdai.lrv.lt

You may also apply to the courts.

9. Children’s data

The website is intended for adults. We do not knowingly collect data about people under 14. Where data is processed on the basis of consent, in Lithuania a person aged 14 or over can consent independently in the case of information society services; processing a younger child’s data requires the consent of a parent or guardian. If we learn that we have collected a younger child’s data without such consent, we erase it.

10. Data security

We apply technical and organisational safeguards: data is transmitted over an encrypted connection, passwords are stored encrypted, access to the administration system is granted only to those who need it for their work, and regular backups are made. We will notify you and the State Data Protection Inspectorate of any personal data breach likely to pose a high risk to your rights, in the manner prescribed by the GDPR.

11. Automated decision-making

We carry out no automated decision-making or profiling that produces legal effects concerning you.

12. Changes to this policy

We may update this policy. The current version is always published on this page, with its date shown at the top. We will give separate notice of material changes affecting data processed on the basis of consent. Donations are governed by the terms of use and of donating.

13. Contact

Send questions about this policy to info@visuotinegynyba.lt or at Žalgirio g. 90, LT-09303 Vilnius.