Privacy policy
General provisions
This privacy policy (the Policy) sets out the rules for processing personal data that apply when you visit the website tobalt.eu (the Website), use its services and interactive tools, and submit enquiries.
The data controller is Laikas atsinaujinti, MB (trade mark: Tobalt), company code 304863231, VAT code LT100013700311, registered address: Vaivadiškių k. 3, LT-29255 Anykščių r. sav., Lithuania; office: Mapu g. 20, Kaunas, Lithuania (the Company, we or us).
tomas@tobalt.lt
+370 668 00 113
When processing personal data we follow Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Law on the Legal Protection of Personal Data of the Republic of Lithuania and other applicable legislation.
What personal data we collect
2.1. Data you provide yourself
When you use the Website and its features, you may provide the following data:
- Contact details – first name, surname, email address, phone number. We collect these when you fill in an enquiry, quote or demo request form. We need them to contact you and reply.
- Organisation details – name of your organisation, job title, field of activity. These help us understand your needs better and prepare a suitable quote in the context of your organisation.
- Content of communications – your messages, questions and comments sent through contact forms. We keep this content so that we can reply properly to your enquiry and, if needed, refer back to the conversation history.
- Interactive tool data – when you use the Website’s calculators and assessment tools (e.g. the process assessment tool or the efficiency calculator), your answers, email address and calculated results. Your email address may be saved automatically while you use the tool, before the whole form is completed, so that you can continue the assessment later and receive the results.
- Website check data – when you use the website check tool, we collect the address of the website you entered and the check results. If you order a detailed report by email, we also store your email address, IP address and the address of the page from which you ordered it. To prepare the detailed report, the address of the checked website (without your personal data) is sent to the Google PageSpeed Insights service. How the check works is described on the page “How we check a website“.
2.2. Data collected automatically
When you visit the Website, we automatically collect certain technical data that helps keep the Website running and improve the user experience:
- Technical data – IP address, browser type and version, operating system, screen resolution, language settings. This data helps make sure the Website displays correctly on your device.
- Usage data – addresses of the pages visited, date and time of the visit, time spent on a page, clicks, scroll depth. This information helps us understand how visitors use the Website and improve its structure and content.
- Cookie data – information collected through cookies and similar technologies. Read more about cookies in Section 7.
Purposes and legal bases of processing
For each processing purpose we apply a specific legal basis and set a clear retention period:
| Purpose | Data categories | Legal basis | Retention period |
|---|---|---|---|
| Handling enquiries and replying to your messages | Contact, organisation and communication data | Consent (Art. 6(1)(a)) /?taxonomy=service-type&term=skaitmeniniu-irankiu-kurimas Legitimate interest (Art. 6(1)(f)) | 2 years from the last contact |
| Preparing quotes and performing contracts | Contact and organisation data | Performance of a contract (Art. 6(1)(b)) | Term of the contract + 3 years |
| Ensuring the operation and security of the Website | Technical data | Legitimate interest (Art. 6(1)(f)) | For the session or up to 30 days |
| Website analytics and improvement (Google Analytics) | Usage and technical data | Consent (Art. 6(1)(a)) | 26 months |
| Operating interactive tools and providing results | Email, tool answers, results, choice of sector | Consent (Art. 6(1)(a)) | 2 years from the last use |
| Generating PDF reports and sending them by email | Contact and organisation data, tool results | Consent (Art. 6(1)(a)) | 2 years from generation |
| Website check and sending the detailed report by email | Address of the checked website, check results, email address, IP address, address of the ordering page | Consent (Art. 6(1)(a)) | Check data without an email address – 30 days; data of an ordered report – 2 years from the date of the order |
| Direct marketing (newsletters, offers) | Email address | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Measuring marketing effectiveness (Mautic) | Usage and technical data | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
Recipients and transfers of data
We may share your personal data with the following recipients only to the extent necessary for the purposes stated above. Each time we assess whether the transfer is proportionate and necessary:
- Hosting provider – the Website’s servers are located in the European Union, so your data does not leave the EU through this channel.
- Cloudflare, Inc. (Turnstile) – data may be transferred to the USA; the transfer is based on the EU-US Data Privacy Framework where the recipient participates in it, or on standard contractual clauses approved by the European Commission.
- Google LLC (Google Analytics, Google Maps) – data transfers to the USA are based on the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
- Form and email service providers – used to forward and process enquiries. Data is processed on servers in the EU.
- Law enforcement authorities – only where required by applicable legislation of the Republic of Lithuania or the European Union.
We do not sell or pass on your personal data to third parties for marketing purposes. Your data is used only for purposes directly related to our services.
Your rights
Under the General Data Protection Regulation (GDPR) you have the following rights, which you can exercise at any time:
You can find out whether we process your data, exactly what data we hold, and receive a copy of it.
If your data is inaccurate or incomplete, you can ask us to correct or complete it.
You can ask us to erase your data when it is no longer needed or the processing is unlawful (the right to be forgotten).
You can ask us to suspend processing temporarily, e.g. while the accuracy of the data is being checked.
You can receive your data in a structured, machine-readable format and transfer it to another controller.
You can object to processing based on legitimate interest if you believe it affects your rights disproportionately.
You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
If you believe your rights have been infringed, you have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (vdai.lrv.lt, L. Sapiegos str. 17, Vilnius).
Data security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction:
- SSL/TLS encryption – the whole Website runs over HTTPS, so data between your browser and our server is encrypted.
- Access control – only authorised staff have access to personal data, and every login is logged.
- Regular updates – the Website platform, plugins and server software are kept up to date to fix known vulnerabilities.
- Backups – automatic backups are made regularly so that information can be restored after an incident.
- Firewalls and monitoring – firewalls and intrusion detection systems continuously monitor for unusual activity.
Cookies
7.1. What cookies are
Cookies are small text files stored on your device when you visit the Website. They help the Website recognise you when you return, remember your settings and understand how you use the Website.
7.2. Cookies we use
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| wordpress_sec_*, wordpress_logged_in_* |
Strictly necessary | Session management and authentication – ensures secure login to the Website’s administration | Session |
| wp_lang | Strictly necessary | Saves the Website language you chose so you do not have to choose it every time | Session |
| _ga, _ga_* | Analytics | Google Analytics – identifies unique visitors and counts Website traffic | 2 years |
| _gid | Analytics | Google Analytics – distinguishes visitors from one another over a 24-hour period | 24 hours |
| _gat | Analytics | Google Analytics – limits the request rate so that servers are not overloaded | 1 minute |
| cc_cookie | Strictly necessary | Saves your choice in the cookie banner (which cookie categories you allowed) | 182 days |
| tobalt_irk_session | Analytics | Tool search usage statistics – a pseudonymous random identifier linked only to tool search actions; set only if you consent to analytics cookies and deleted when you withdraw consent | 1 year |
7.3. Managing cookies
You can manage and delete cookies in your browser settings. Please note that disabling some cookies may affect how the Website works – for example, login or language selection may stop working.
Cookie settings in the most popular browsers:
Third-party services
The Website uses the following third-party services, which may process some of your data. Analytics and marketing tools are switched on only if you consent in the cookie banner; you can change your choice at any time in the cookie settings.
- Google Analytics – a web analytics tool that helps us understand how visitors use the Website. The data is anonymised and used for statistical purposes only. Google privacy policy. You can opt out of tracking by installing the Google Analytics Opt-out browser add-on.
- Mautic – a marketing automation system run by us (mautic.laikasatsinaujinti.lt) that records the pages viewed so that our offers are more relevant. Switched on only if you consent to marketing cookies.
- Cloudflare Turnstile – protection against automated (spam) submissions in forms. Loaded only once you start using the page (e.g. click into a form field); for the check, Cloudflare receives your IP address and technical browser data. Legal basis: legitimate interest in protecting the forms (Art. 6(1)(f)). Cloudflare privacy policy.
- Google Maps – the map on the contact page. Loaded only when you click “Show map”; Google then receives your IP address and browser data. Google privacy policy.
- Fonts – stored on our server, so no data is passed to third parties when they load.
- Website forms – enquiry, quote and tool forms run on our Website; the data submitted is processed and stored on our server in the European Union.
Data of minors
The Website and its services are not intended for persons under 16. We do not knowingly collect or process children’s personal data. If we learn that a minor’s data has been collected without the consent of a parent or guardian, we will delete it immediately and inform the person concerned.
Changes to this Policy
This Policy may be updated to reflect changes in legislation, technology or our activities. We will announce significant changes on the Website and, in important cases, by email if we have your contact details.
We recommend that you review this page from time to time to stay informed of the latest terms.