Privacy Policy · MB Kirstuko Mokslas (kirmok)

We keep little data, keep it in the European Union, and never sell it. This page says exactly what we hold, why, for how long, and what you can ask of us.

1. Who is responsible for your data

1.1 MB Kirstuko Mokslas ("kirmok", "we", "us"), company code 307159816, Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania, is the controller for the personal data described in this policy. You can reach us about anything in it at info@kirmok.net or +370 612 20447.

1.2 This policy covers visitors to kirmok.net and the people we deal with as customers, prospective customers, suppliers and contacts. For data inside the systems we host for our customers, see section 6.

2. This website

2.1 kirmok.net is a static website. It sets no cookies, runs no analytics or tracking scripts, and loads nothing from third-party servers.

2.2 Like any web server, ours records an access log: the IP address a request came from, the time, the page requested and the browser identification string. We use the log only to keep the site secure and to diagnose faults, on the basis of our legitimate interest in running a secure service (Art. 6(1)(f) GDPR). Entries are deleted after no more than 30 days.

3. Enquiries, quotes and customer relationships

3.1 What we collect: your name, organisation and role; email address, phone number and postal address; the content of our correspondence; and, for customers, billing details (billing address, company code, VAT number), the services ordered, invoices and payment records, and support requests.

3.2 Where it comes from: from you, from colleagues of yours who involve you in our work, and from public registers (company and VAT registers) when we verify billing details.

3.3

Why, and on what legal basis:

to answer enquiries and prepare quotes (steps before a contract, Art. 6(1)(b) GDPR);
to deliver and support the services you ordered, and to communicate about them (performance of a contract, Art. 6(1)(b));
to issue invoices and keep accounts (legal obligation, Art. 6(1)(c), under Lithuanian accounting and tax law);
to keep our systems secure, keep records of what we agreed, and establish or defend legal claims (legitimate interests, Art. 6(1)(f)).

3.4 We do not send marketing email or newsletters. We contact you only about the work we do for you: enquiries, quotes, invoices, support, service notices and changes to our terms.

4. Payments

4.1 Bank transfer: we see what your bank sends with the payment, normally the payer name, account number, amount and reference, and keep it with the invoice.

4.2 Card: card payments are processed by Stripe Payments Europe, Ltd. ("Stripe", Dublin, Ireland). You enter your card details on pages operated by Stripe; the card number never reaches our systems. Stripe tells us whether the payment succeeded, the amount, the card brand and its last four digits, the name and email given with the payment, and the identifiers Stripe assigns. Stripe processes your data under its own privacy policy, stripe.com/privacy, and acts as an independent controller for purposes such as fraud prevention. Stripe may transfer data to its group companies in the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses.

5. Who else receives your data

5.1 Our accountant in Lithuania, who receives invoices and payment records.

5.2 Our bank, for payments, and Stripe, for card payments, as described above.

5.3 The providers of the systems we use to run our business. Our infrastructure is in Lithuania, and encrypted backups of it are stored with Hetzner Online GmbH in Germany.

5.4 Public authorities, courts and professional advisers, where the law requires it or where we need to establish or defend a claim.

5.5 We do not sell personal data, and we do not share it for advertising.

6. Data in the systems we host for customers

6.1 When you use a website or application that one of our customers hosts with us, that customer decides what data is collected and why, and is the controller. We process that data only on the customer's instructions, under a data processing agreement, as a processor under Art. 28 GDPR.

6.2 Requests about such data should go to the customer whose service you used. If one reaches us, we pass it on and help the customer respond.

7. How long we keep data

7.1 Enquiries that do not lead to an agreement: 12 months after our last exchange.

7.2 Agreements, orders, quotes and the correspondence needed to perform and prove them: for the duration of the relationship and 10 years after it ends, the general limitation period under Lithuanian law.

7.3 Invoices and accounting records: 10 years, as Lithuanian accounting law requires.

7.4 Website access logs: no more than 30 days.

7.5 Backups of our own systems are rotated on a fixed schedule. Data deleted from our live systems disappears from backups as those are rotated out.

8. Your rights

8.1 You can ask us for access to the personal data we hold about you, to correct or delete it, to restrict its processing, and to receive the data you gave us in a portable format. Where processing rests on our legitimate interests, you can object for reasons relating to your particular situation.

8.2 Write to info@kirmok.net. We answer within one month. We may ask you to confirm your identity first.

8.3 You can also complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the supervisory authority where you live.

9. How we protect data

9.1 All connections to our systems are encrypted. Data is stored on encrypted disks and in encrypted backups, within the European Union. Access is limited to the people who need it for their work, and our software is kept up to date.

9.2 If a personal data breach affects you, we notify you and the supervisory authority as the GDPR requires.

10. Changes to this policy

10.1 We update this policy when our practices change, and show the date of the current version at the top. Changes that affect our customers are announced by email.