Privacy policy

1. Who is responsible

The controller of personal data processed through the exchange is MB „Laikas atsinaujinti“, company code 304863231, registered office Vaivadiškių k. 3, LT-29255 Anykščių r., Lithuania. Privacy questions and requests: [to be provided: privacy contact email].

2. Whose data we process

• Member contacts: people who register for a member company or are added to its team.
• Buyers: people who send a request through the buyer form, and buyer contacts that a member passes on in a lead.
• Visitors: people who use the public pages or write through the contact form.

3. What we collect, why, and on what legal basis

• Account and team data (name, work email, phone, role, login records) to provide the membership. Legal basis: contract with the member company and our legitimate interest in knowing who acts for it.
• Company verification data (company code, VAT number, address, results of register and VIES checks) to check that members are real businesses. Legal basis: legitimate interest in a trustworthy exchange.
• Buyer requests (company name, contact person, email, phone, the request) to pass the request to matching manufacturers. Legal basis: the buyer's consent, given on the form; it can be withdrawn at any time for the future.
• Waiting list (company name, email, the field chosen) to tell you once when registration opens for that field. Legal basis: your consent, given on the form; every email has a link to leave the list. [Note for the lawyer: please confirm consent is the right basis and the wording next to the checkbox.]
• Buyer contacts in member leads to introduce the buyer to a manufacturer that can serve them. Legal basis: our and the member's legitimate interest; the member confirms that the buyer agreed to be referred.
• Disclosure log: a record of every time contact details are shown to a member, to protect buyers and resolve complaints. Legal basis: legitimate interest and accountability.
• Billing data (invoice details, payment status; card or bank details are held by the payment provider, not by us) to charge fees and keep accounting records. Legal basis: contract and legal obligation.
• Messages sent through the contact form, to answer them. Legal basis: legitimate interest.
• Technical data (IP address, browser, error and security logs) to run and protect the service. Legal basis: legitimate interest.

Contact details of buyers and member contacts are stored encrypted.

4. Who receives the data

• Matched manufacturers receive a buyer's company name, contact details and request only after they accept the request. Up to 3 manufacturers can receive one buyer request.
• Processors working for us under a data processing agreement:
  • Hosting: Hetzner Online GmbH, data centres in the European Union [to be confirmed at launch: data centre location].
  • Email delivery: [to be confirmed at launch: email provider, its location and transfer safeguards].
  • Payments: [to be confirmed at launch: payment provider].
  • Backups: [to be confirmed at launch: backup storage provider, in the European Union].
• Authorities, when the law requires it.

We aim to keep all data in the European Union. If a processor outside the European Union is ever used, we will name it here with the safeguard that applies.

5. After a contact is revealed

Once a manufacturer accepts a request and sees the buyer's details, it uses them on its own responsibility to answer that request. Members agree in the terms of service not to use these details for anything else. [Note for the lawyer: please confirm the roles of the platform and of the manufacturer after disclosure, separate controllers or otherwise.]

6. How long we keep data

• Contact details of a buyer request that no manufacturer accepted are deleted or anonymised after 90 days.
• Waiting-list entries: unconfirmed ones are deleted after 7 days, the others 30 days after the opening notice and in any case after 365 days.
• Accepted requests and the disclosure log are kept as long as needed for the deal records, the success fee and possible claims: [to be decided with the lawyer: period].
• Account data are kept while the membership lasts and then deleted or anonymised, except what accounting law requires us to keep.
• Invoices and accounting records are kept for the period required by Lithuanian accounting law.
• Contact form messages: [to be decided with the lawyer: period].

7. Your rights

You may ask for access to your data, a copy of it, correction, deletion, restriction of processing, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time. Members can download their own data and ask for deletion in their account settings. Everyone else can write to [to be provided: privacy contact email]. We answer within one month.

You may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, www.vdai.lrv.lt) or the data protection authority where you live.

8. Cookies

The site uses only cookies needed for logging in and security. The cookie policy lists them.

9. Changes

We will publish changes to this policy on this page and tell members by email about important ones.