1. General provisions
This privacy policy explains how UAB „Gera vata“, which operates the website bunker24.lt (the “Company”, “we”, “us”), collects, uses and stores personal data when you visit the website, submit an enquiry, contact us by email or telephone, receive a quote or enter into a contract with us.
We process personal data in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, the “GDPR”);
- the Law on the Legal Protection of Personal Data of the Republic of Lithuania;
- the Law on Electronic Communications of the Republic of Lithuania (provisions on cookies and direct marketing);
- other legislation of the Republic of Lithuania and the European Union.
This policy applies to natural persons: website visitors, prospective and existing clients, and employees and representatives of businesses, state and municipal bodies and institutions (e.g. schools and kindergartens) who communicate with us on behalf of their organisation. Data about organisations themselves (name, registration number, address) is not personal data, but we process the data of their contact persons in accordance with this policy.
When processing personal data, we follow these principles:
- we process data lawfully, fairly and transparently;
- we collect only as much data as is needed for a specific purpose;
- we keep data no longer than necessary or than required by law;
- we ensure appropriate security and confidentiality of data;
- we do not sell personal data or pass it on to third parties for their own marketing purposes.
Our website and services are intended for organisations and adults. We do not knowingly collect personal data from children.
We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
The terms used in this policy (personal data, controller, processor, data subject, consent, etc.) have the meanings given to them in Article 4 GDPR.
2. Data controller
The controller of your personal data is:
- Name: UAB „Gera vata“ (trade mark BUNKER 24)
- Company code: 301785578
- VAT number: LT100004187915
- Address: Senasis Ukmergės kl. 4, Avižieniai, 14180 Vilniaus r. sav., Lithuania
- Telephone: +370 685 09501, +370 621 09699
- Email: info@bunker24.lt
- Website: bunker24.lt
For any questions about the processing of personal data, please contact us at info@bunker24.lt (with “Personal data” in the subject line) or in writing at the address above. We have not appointed a data protection officer, as this is not mandatory for us under Article 37 GDPR.
3. What data we collect and where from
3.1. Enquiry form on the website
When you request a consultation or a quote using the enquiry form, you provide:
- required – your name, email address, telephone number, site location (municipality) and message;
- optional – the name of your company or organisation, the bunker type and the number of people.
In the form you also confirm that you have read the information on data processing and answer a simple anti-spam question. The following is sent automatically with the enquiry: the address of the page on which the form was completed, the website language, the position of the form on the page, and the date and time of sending.
The site location and the number of people are usually information about an organisation’s needs. They become personal data only when they relate to a specific natural person (e.g. the location of a private individual’s plot).
How the form works. The completed form is sent by email to our mailbox info@bunker24.lt, with your email address set as the reply-to address. We do not store the content of enquiries on the website server – neither in a database nor in files: the enquiry remains only in our email (see Section 4 for retention periods). If the form is returned because of an error, the data you entered is kept temporarily only in your browser’s session storage (sessionStorage), so that you do not have to type it again, and is deleted immediately afterwards.
Spam protection. We ask you to answer a simple question, check that the domain of your email address exists and limit the number of enquiries from a single IP address. The IP address itself is not recorded: only its hash (an HMAC-SHA256 digest; for IPv6 addresses – of the /64 network part) and the time of the attempt are kept, for no longer than 1 hour (enquiry limit) or 10 minutes (wrong answers to the anti-spam question). The form content and IP addresses are not written to the server error log.
3.2. Correspondence by email and telephone
When you contact us by email or telephone, we process your contact details, the content of the correspondence, any attached documents (e.g. site plans, technical requirements, photos) and the date of contact. We do not record telephone calls.
3.3. Quotes and contracts
When preparing a quote and entering into and performing a contract, we process the name, surname, position, contact details and signature of the client or their representative, the site address, and order, delivery, installation and payment information. If the client is a natural person, their home address and invoice details may also be processed.
3.4. Data collected automatically
- Server logs. The website hosting server automatically records technical data: IP address, time of request, requested address, browser type and referring source.
- Analytics and ad measurement – only with your consent. When you click “Accept” in the cookie notice, the Google Analytics 4 and Google Ads tags are loaded (see Section 8 and the cookie policy). Until you click “Accept”, these tags are not loaded and no data is sent to Google.
3.5. Data obtained from other sources
- from the organisation you represent (e.g. when a colleague names you as the contact person for a project);
- from our partners (design engineers, contractors) when they pass your enquiry on to us at your request.
We do not request or process special categories of personal data (e.g. health data). Please do not include such data in the form or in emails.
4. Purposes of processing, legal bases and retention periods
We process personal data only where at least one of the legal bases set out in Article 6(1) GDPR applies.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Handling enquiries, consultations, answering questions | Form data (name, company / organisation, email, telephone, bunker type, number of people, site location, message), correspondence, attached documents | Steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); where you contact us on behalf of an organisation – our legitimate interest in responding to the organisation’s enquiry (Article 6(1)(f) GDPR) | 2 years from the last contact if no contract is concluded |
| Preparing quotes, design solutions and cost estimates | Contact details, organisation, site location and conditions, needs, correspondence | Article 6(1)(b) GDPR (for a client who is a natural person); Article 6(1)(f) GDPR (for a representative of an organisation) | 3 years from the quote if no contract is concluded |
| Concluding and performing contracts (design, organising manufacture, delivery, installation, fit-out, warranty obligations) | Name, surname, position, contact details and signature of the client / representative, site address, order, delivery and installation information | Performance of a contract (Article 6(1)(b) GDPR); where the contracting party is an organisation – legitimate interest (Article 6(1)(f) GDPR) | For the term of the contract and 10 years after it ends |
| Accounting and tax compliance | Invoice, payment and contract data | Legal obligation (Article 6(1)(c) GDPR) | 10 years |
| Correspondence by email and telephone, keeping a record of communications | Contact details, content of emails, attachments, date of contact | Legitimate interest in ensuring proper communication and proving agreements (Article 6(1)(f) GDPR) | Together with the related enquiry or contract (see above); other emails – 2 years |
| Establishment, exercise or defence of legal claims, handling of complaints | Data relating to the dispute | Legitimate interest (Article 6(1)(f) GDPR) | Until the dispute is finally resolved and the decision is enforced |
| Direct marketing (offers and news by email) | Name, email, telephone, organisation | Consent (Article 6(1)(a) GDPR); for existing clients – regarding similar services under the Law on Electronic Communications, with the option to opt out at any time | Until you withdraw consent or opt out, but no longer than 3 years from when consent was given or last renewed |
| Protecting the enquiry form against spam and abuse | Hash of the IP address (HMAC-SHA256), time of the attempt | Legitimate interest in protecting the form and our mailbox (Article 6(1)(f) GDPR) | Up to 1 hour (wrong answers to the anti-spam question – up to 10 minutes) |
| Ensuring the operation and security of the website | IP address, technical browsing data, server logs, strictly necessary cookie | Legitimate interest in ensuring the operation and security of the website (Article 6(1)(f) GDPR); strictly necessary cookie – exemption for technically necessary storage under the Law on Electronic Communications | Server logs – up to 6 months; strictly necessary cookie – 12 months |
| Website analytics and improvement (Google Analytics 4) | Pseudonymous cookie identifiers, device and browser information, approximate location (country, city), pages visited and actions taken | Consent (Article 6(1)(a) GDPR) | Cookies – up to 400 days; data in Google Analytics – no longer than 14 months |
| Measuring advertising effectiveness and remarketing (Google Ads) | Ad click identifier, pseudonymous cookie identifiers, pages visited, the fact of a conversion (enquiry sent, telephone link clicked) | Consent (Article 6(1)(a) GDPR) | Cookies on the website domain – up to 90 days, cookies on Google domains – up to 13 months; Google retains other data under its own rules |
Legitimate interest. Where we process data on the basis of legitimate interest (responding to organisations’ enquiries, performing contracts, protecting the form and the website, defending our rights), we assess whether it is overridden by your interests or fundamental rights and freedoms. You have the right to object to such processing at any time on grounds relating to your particular situation (see Section 9).
Consent. Where we process data on the basis of your consent, you can withdraw it at any time as easily as you gave it: by clicking “Cookie settings” at the bottom of the website, by clicking the unsubscribe link in an email or by writing to info@bunker24.lt. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).
Do you have to provide your data? Providing data is voluntary. However, without the data marked as required in the form we cannot respond to your enquiry or prepare a quote, and without the data necessary to conclude a contract we cannot conclude or perform it.
When the retention period expires, we securely delete or anonymise the data. We may keep data for longer if required by law or if it is needed for an ongoing dispute, investigation or legal proceedings.
5. Data recipients and processors
We may disclose your personal data only to the extent necessary for a specific purpose.
Data processors
Data processors are service providers that process data on our behalf and on our instructions. We conclude contracts with them that meet the requirements of Article 28 GDPR and oblige them to ensure the confidentiality and security of the data.
| Processor category | Purpose |
|---|---|
| Website hosting provider | Operation of the website, sending enquiry emails, server logs |
| Email service provider | Storage of the info@bunker24.lt mailbox and correspondence |
| Website development and maintenance provider | Technical maintenance of the website, bug fixing |
| Accounting service provider | Handling invoices and other accounting documents |
| Google Ireland Limited (Google Analytics 4) – only with your consent | Website traffic statistics |
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides the Google Analytics 4 and Google Ads services. For Google Analytics, Google processes data on our behalf as a data processor (under the Google Ads Data Processing Terms). For Google Ads, Google acts as an independent data controller (under the Google Ads Controller-Controller Data Protection Terms) and may also use the data for its own purposes in accordance with its privacy policy. Both services run only with your consent. More about how Google processes data: business.safety.google/privacy.
Other recipients
Where necessary to handle an enquiry or perform a contract, we may pass data on to:
- manufacturing partners (plants) – only technical order data (model, dimensions, configuration, delivery terms), without personal data;
- transport, installation and fit-out subcontractors – the site address and the contact person’s details to coordinate the work;
- design engineers and experts who are not our employees – information needed for the design;
- legal, audit and consultancy service providers – where needed to defend our rights or comply with legal obligations;
- state authorities, courts and law enforcement – only in the cases and in the manner provided by law.
We do not sell data or provide it to third parties for their own direct marketing purposes.
6. Transfers of data outside the European Economic Area
We process your personal data in the European Union and the European Economic Area (EEA) and do not ourselves transfer it outside the EEA. We send manufacturing partners, including those outside the EEA, only technical order data without personal data.
If you have consented to analytics and advertising cookies, Google Ireland Limited or its sub-processors (e.g. Google LLC) may also process data outside the EEA, for example in the United States. In that case, the safeguards provided for in Chapter V GDPR apply:
- an adequacy decision of the European Commission (Article 45 GDPR) – for US organisations certified under the EU-U.S. Data Privacy Framework;
- standard data protection clauses adopted by the European Commission or other appropriate safeguards (Article 46 GDPR).
For more information about the safeguards applied, please write to info@bunker24.lt.
7. Data retention
We keep personal data no longer than necessary for the purposes for which it was collected, or as required by law. The specific retention periods for each purpose are set out in the table in Section 4.
When setting retention periods, we take into account:
- the nature of the enquiry or project – planning, funding and procurement for organisations and institutions often take more than a year, so we keep enquiries and quotes for as long as is reasonably needed to complete this cycle;
- the retention periods for accounting documents laid down by law;
- limitation periods and warranty obligations;
- the validity of your consent (for marketing and cookies).
We do not store the content of the enquiry form on the website server – it is kept only in our email for the periods stated above. When the retention period expires, we delete or anonymise the data so that you can no longer be identified. We review stored data at least once a year and delete data that is no longer needed.
9. Your rights as a data subject
Under the GDPR, you have the following rights:
- Right of access (Article 15 GDPR) – to obtain confirmation as to whether we process your data, a copy of it and information about the processing.
- Right to rectification (Article 16 GDPR) – if the data is inaccurate or incomplete.
- Right to erasure (“right to be forgotten”) (Article 17 GDPR) – where the data is no longer needed, you have withdrawn consent, you have validly objected to the processing or the data is processed unlawfully, except where we are required to keep it by law or need it to defend legal claims.
- Right to restriction of processing (Article 18 GDPR) – for example, while the accuracy of the data or your objection is being verified.
- Right to data portability (Article 20 GDPR) – to receive the data you have provided in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller, where the data is processed by automated means on the basis of your consent or a contract.
- Right to object (Article 21 GDPR) – where we process data on the basis of legitimate interest. You can object to processing for direct marketing purposes at any time without giving reasons, and we will then stop processing your data for that purpose.
- Right to withdraw consent at any time (Article 7(3) GDPR) – where data is processed on the basis of your consent; for cookies – by clicking “Cookie settings” at the bottom of the website.
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR) – see Section 11.
These rights are not absolute – their exercise may be restricted in the cases provided for by the GDPR and other legislation. If we cannot fulfil your request, we will explain the reasons in writing.
10. How to submit a request and how quickly we respond
You can submit a request to exercise your rights:
- by email to info@bunker24.lt (with “Personal data” in the subject line);
- in writing, by post or in person at Senasis Ukmergės kl. 4, Avižieniai, 14180 Vilniaus r. sav., Lithuania, building 3, 3rd floor (meetings by prior arrangement only).
In your request, please state your name, surname, contact details, which right you wish to exercise and, if possible, which data or processing operations the request concerns (e.g. the date of your enquiry or the email address you used to communicate with us).
Verification of identity. To make sure that your data is not disclosed to another person, we may ask for additional information to verify your identity – for example, to send the request from the same email address you used to communicate with us, or to sign the request with a qualified electronic signature. A request may also be submitted by your representative with a document confirming their authority.
Response time. We respond to requests without undue delay and in any event within one month of receipt. Taking into account the complexity and number of requests, this period may be extended by a further two months where necessary – we will inform you of any extension and the reasons for it within the first month (Article 12(3) GDPR).
Fee. Information and action taken on your request are free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request (Article 12(5) GDPR).
11. Complaints to the State Data Protection Inspectorate
If you believe that your personal data is being processed in breach of the law, we invite you to contact us first – we will do our best to resolve the issue promptly.
You also have the right to lodge a complaint with the supervisory authority – the State Data Protection Inspectorate (VDAI):
- Address: L. Sapiegos g. 17, 10312 Vilnius, Lithuania
- Email: ada@ada.lt
- Website: vdai.lrv.lt
A complaint can be submitted to VDAI electronically – through the e-services indicated by VDAI or the “E. pristatymas” e-delivery system, by email signed with a qualified electronic signature, by registered post or in person at VDAI’s premises.
You may also contact the supervisory authority of another EU Member State in which you live or work or in which the alleged infringement took place, or defend your rights in court.
12. Data security
We implement appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, loss or any other unlawful processing (Article 32 GDPR). Among other things:
- data is transmitted over an encrypted connection (HTTPS / TLS);
- the content of the enquiry form is not stored on the website server, and the form protection files (IP address hashes) are closed to access from the internet and cleared automatically;
- access to personal data is granted only to employees and partners who need it for their work, and they are bound by confidentiality;
- we use accounts protected by passwords and, where possible, two-factor authentication;
- we regularly update software and make backups;
- we conclude contracts with data processors requiring them to ensure at least the same level of security.
In the event of a personal data breach, we will notify VDAI in the cases and within the time limits set out in Articles 33 and 34 GDPR and, where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you.
No method of transmission over the internet or of storage is completely secure, so we recommend that you do not send us excessive or particularly sensitive information through the form or by email.
13. Changes to this privacy policy
We review this privacy policy and update it when our activities, the technologies we use or the law change. The current version is always published on this page with its effective date.
We will announce material changes (e.g. new purposes of processing or new cookies) on the website and, where we have your contact details and the changes are relevant to you, by email. If the changes require your consent, we will ask for it separately (e.g. the cookie notice will be shown again).
If you have any questions about this policy, please write to info@bunker24.lt or call +370 685 09501, +370 621 09699 (Mon–Fri 8:00–20:00).