This privacy policy explains what personal data I process when you visit gbareikis.lt, send an enquiry or use my services, and what rights you have under the General Data Protection Regulation (GDPR, EU 2016/679).
1. Data controller
The data controller is Gabrielius Bareikis, Vilnius, Lithuania. Contact: email info@gbareikis.lt, phone +370 609 44647. You can use these contacts for any questions about personal data.
2. What data I process and why
Enquiry form
- Data: name, email address, the services selected, the content of the message and the time it was sent.
- Purpose: to reply to your enquiry and prepare a proposal.
- Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- Retention: the enquiry and correspondence are kept for 2 years after the last contact.
- Spam protection: to stop the form being submitted many times in a row, an encoded IP address record is briefly stored on the server. It is not linked to the enquiry, does not appear in the email and is not used for any other purpose. Basis: legitimate interest in protecting the form from abuse (Article 6(1)(f) GDPR).
Correspondence by email and phone
- Data: your contact details and the content of the correspondence.
- Purpose and basis: to answer your questions and discuss a project (Article 6(1)(b) and (f) GDPR).
- Retention: 2 years after the last contact.
Providing services
- Data: name or company name, company details, contact details, contract and invoice data.
- Purpose and basis: entering into and performing a contract (Article 6(1)(b) GDPR), accounting and tax obligations (Article 6(1)(c) GDPR).
- Retention: contracts and accounting documents are kept for 10 years, as required by the laws of the Republic of Lithuania.
AI chat assistant
- Data: the messages you write in the chat and the assistant’s replies.
- Purpose: to answer questions about services and prices straight away.
- Legal basis: legitimate interest in answering your questions (Article 6(1)(f) GDPR), and, if you leave your contact details, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- How it works: messages are passed through my server to Anthropic’s artificial intelligence model (Claude), which generates the reply. The content of conversations is not stored on my server; the chat is kept only in your browser until you close the tab. Anthropic does not use API data to train its models and deletes it in accordance with its terms. Please do not write sensitive personal data in the chat.
- Leaving contact details: if you click “Leave contact details” in the chat, your name, email and the chat transcript are sent to me as an enquiry and processed in the same way as enquiry form data.
- Abuse protection: an encoded IP address record is stored briefly (up to 10 minutes) so that the assistant is not used en masse.
Website traffic analytics (only with your consent)
- Tools: Google Analytics 4 and Microsoft Clarity.
- Data: pseudonymous browser identifiers, pages viewed, clicks and scrolling, visit duration, device and browser type, approximate location (country or city), where you came to the website from. Microsoft Clarity may record anonymised browsing sessions; text entered in form fields is masked.
- Purpose: to understand how visitors use the website and to improve it.
- Legal basis: your consent (Article 6(1)(a) GDPR).
- Retention: Google Analytics data is kept for up to 14 months. Microsoft Clarity session recordings are kept for up to 30 days, aggregated data for up to 13 months.
Measuring advertising effectiveness (only with your consent)
- Tools: Google Ads and Meta (Facebook) Pixel via Google Tag Manager.
- Data: pseudonymous identifiers, pages visited and whether a visit after an ad click ended in an enquiry. If you are logged in to Facebook or Instagram, Meta may link this data to your account in accordance with its own privacy policy.
- Purpose: to assess whether advertising achieves its goal and to manage it more effectively.
- Legal basis: your consent (Article 6(1)(a) GDPR).
- Retention: according to the cookie lifetimes listed in the cookie policy.
Server logs
- Data: IP address, request time, address visited, browser information.
- Purpose and basis: website security and ensuring that it works, legitimate interest (Article 6(1)(f) GDPR).
- Retention: for a short time, according to the hosting provider’s settings.
3. Consent and withdrawing it
Analytics and advertising cookies are used only when you choose “Accept” in the cookie banner or switch them on in the settings. Until you give consent, Google Tag Manager is loaded with Google Consent Mode: Google Analytics and Google Ads then set no cookies and receive only anonymous, cookie-free signals (for example, that a page was opened), from which Google statistically estimates traffic and advertising results. Meta (Facebook) Pixel and Microsoft Clarity are not loaded without consent. You can change or withdraw your consent at any time by clicking “Cookie settings” at the bottom of the website or . Withdrawal does not affect the lawfulness of processing carried out before it.
4. Who receives the data
I do not sell data. It may be received only by service providers who help the website run and who process data on my instructions:
- Hostinger: website hosting and email services.
- Google Ireland Limited: Google Analytics, Google Tag Manager, Google Ads (only with consent).
- Microsoft Ireland Operations Limited: Microsoft Clarity (only with consent).
- Meta Platforms Ireland Limited: Meta (Facebook) Pixel (only with consent).
- Anthropic: generating the AI chat assistant’s replies (only if you write to the assistant).
Data may also be provided to public authorities where the law requires it.
5. Transfers of data outside the European Economic Area
Google, Microsoft, Meta and Anthropic may transfer data to the United States. In that case the safeguards provided for by the GDPR apply: the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.
6. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased (“the right to be forgotten”);
- restrict the processing of your data;
- object to your data being processed on the basis of legitimate interest;
- receive the data you provided in a structured format and transfer it to another controller;
- withdraw your consent at any time.
To exercise your rights, write to info@gbareikis.lt. I will reply no later than within 1 month. If you believe your data is being processed in breach of the law, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania: L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt.
7. Automated decisions
No decisions that have legal consequences for you are made solely by automated means.
8. Data security
The website runs over an encrypted HTTPS connection, and access to data is granted only as far as necessary. Organisational and technical measures are applied to protect data from unauthorised access, loss or alteration.
9. Changes to this policy
This policy may be updated, for example when the tools used or the law change. The latest version is always published on this page with the date of the update.