Privacy Policy

1. Who is responsible for your data

1.1 MB Kirstuko Mokslas ("kirmok", "we", "us"), company code 307159816, Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania, is the controller for the personal data described in this policy. You can reach us about anything in it at info@kirmok.net or +370 612 20447.

1.2 This policy covers three things: visiting kirmok.net (section 2); contacting us with an enquiry (section 3); and paying us (section 4). Our clients and suppliers receive a separate notice about how we handle the details of the people we work with there. This policy does not cover data inside the websites and systems we host or operate for our clients; see section 6.

1.3 For questions about this policy, contact us at info@kirmok.net.

2. This website

2.1 kirmok.net is a static website. It sets no cookies, runs no analytics or tracking scripts, and loads nothing from third-party servers.

2.2 Like any web server, ours records an access log: the IP address a request came from, the time, the address and page requested, the request method and the server's response. We use the log only to keep the site secure and to diagnose faults, on the basis of our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). The log stays on our own servers in Lithuania and is not shared with anyone. How long entries are kept is in section 7.

3. Contacting us

3.1 What we collect: your name, organisation and role; your email address and phone number; and the content of our correspondence.

3.2 Where it comes from: from you, or from a colleague who passes your enquiry on to us.

3.4 We do not send marketing email or newsletters. We contact you only about the work we do for you: enquiries, quotes, invoices, support, service notices and changes to our terms.

3.5 You don't have to give us any personal data to contact us, but we need a way to reply.

4. Payments

4.1 When you pay us, we keep the payment record with the invoice, because Lithuanian accounting and tax law requires it (Art. 6(1)(c) GDPR).

4.2 Bank transfer: we see what your bank sends with the payment, normally the payer name, account number, amount and reference, and keep it with the invoice.

4.3 Card: where we offer card payment, it is handled by a card payment provider. You enter your card details on pages the provider operates, and the card number never reaches our systems. The provider tells us whether the payment succeeded, the amount, the card brand and its last four digits, and the name and email given with the payment. It processes your data under its own privacy policy, including for fraud prevention and its own legal obligations. We will name the provider here before card payments start.

5. Who else receives your data

5.1 Email: Proton AG, Switzerland, hosts our email. Switzerland is covered by an EU adequacy decision.

5.2 Accounting: our accounting firm in Lithuania receives payment records, and the State Tax Inspectorate receives what the law requires.

5.3 Payments: the banks that carry out payments, and the card payment provider described in 4.3.

5.4 Public authorities, courts and professional advisers, where the law requires it or where we need to establish or defend a claim.

5.5 We do not sell personal data, and we do not share it for advertising.

6. Data in the systems we host for clients

6.1 When you use a website or application that one of our clients hosts with us, that client decides what data is collected and why, and is the controller. We process that data only on the client's instructions, as a processor under Art. 28 GDPR. That client's own privacy notice applies.

6.2 Requests about such data should go to the organisation whose service you used. If one reaches us, we forward it to that organisation and tell you we have done so; we can't answer it ourselves.

7. How long we keep data

7.1 Enquiries: as long as we need them to answer you and discuss possible work. If no agreement follows, we delete them, unless we need them to establish or defend a claim.

7.2 Payment records: 10 years, as Lithuanian accounting rules require.

7.3 Website access logs: overwritten as new entries arrive, and kept only as long as needed to keep the site secure and diagnose faults. They are not archived.

8. Your rights

8.1 You can ask us for access to the personal data we hold about you, and to correct it, delete it or restrict its processing.

8.2 You have the right to object. Where we process your data on the basis of our legitimate interests (sections 2 and 3), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend a legal claim.

8.3 To use any of these rights, write to info@kirmok.net, or contact us any other way. We reply within one month. For complex requests we may extend this by up to two months, and if so we tell you why within the first month. We may ask you to confirm your identity where we have real doubt about it.

8.4 If you are unhappy with how we handle your data, please tell us first, and we will do our best to put it right. You also have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, +370 5 271 2804, ada@ada.lt, vdai.lrv.lt, or to the data protection authority where you live or work.

8.5 We make no decisions about you by automated means alone, and we do not profile you.

9. How we protect data

9.1 Connections to our website are encrypted, and access to personal data is limited to the people who need it for their work.

9.2 If a personal data breach is likely to put you at high risk, we tell you without undue delay, and we notify the supervisory authority as the GDPR requires.

10. Changes to this policy

10.1 We update this policy when our practices change, and show the date of the current version at the top. Changes that affect our customers are announced by email.