Privacy policy
Effective from 21 October 2026
This policy explains what data about you we process when you visit www.bernitis.eu or contact us, on what basis, who receives it and what rights you have. It follows the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Data controller
UAB Bernitis, company code 304867991, VAT code LT100012440316, Smalinės g. 5-4, LT-06226 Vilnius, Lithuania.
For any question about personal data write to [email protected] or call +370 674 67480.
2. Visit statistics
We measure visits with Umami, an open-source tool we run ourselves on our own server in Lithuania. Umami uses no cookies and does not store your IP address: the address is used only during the visit to derive a one-off anonymous identifier and an approximate location, and is not kept.
| Data collected | Example |
|---|---|
| Page viewed | /en/contact/ |
| Date, time and length of the visit | 2026-10-21 14:20, 51 s |
| Where you came from | google.com |
| Browser, operating system, device type | Chrome, iOS, mobile |
| Browser language | en |
| Approximate location — country and city | Lithuania, Vilnius |
| How much of the page was viewed and for how long it was visible | 50 % of the page, 60 s |
Viewing is recorded only in steps: whether you reached 25, 50, 75 or 100 % of the page and whether it was visible on screen for 15 and 60 seconds. We do not record what you type or click.
This data is aggregated and does not let us identify you. We do not combine it with other information or use it for advertising, profiling or automated decisions.
3. Website delivery and security
The website is hosted and delivered through Cloudflare. Cloudflare processes technical request data (IP address, browser type, time of request) to keep the website available, fast and protected from attacks. The website cannot run without it.
4. When you contact us
The enquiry form on the contact page sends nothing anywhere: it opens your email app with a prepared message, and you send it yourself. We receive the data only when you send that email.
When you email or call us, we process your name, company, contact details and the content of our correspondence — as far as needed to answer your enquiry and discuss possible work together.
The website has no registration, login or newsletter — we collect no other data.
5. Legal bases
| Processing | Basis |
|---|---|
| Visit statistics | GDPR Art. 6(1)(f) — legitimate interest in understanding how the website is used and improving it |
| Website delivery and security | GDPR Art. 6(1)(f) — legitimate interest in keeping the website running and secure |
| Answering your enquiry | GDPR Art. 6(1)(b) — steps at your request before entering into a contract, or (f) — legitimate interest in communicating with clients |
6. Cookies
This website sets no cookies of its own, so we show no cookie banner. If you choose the light or dark theme, that choice is stored only in your browser and is not sent to us.
Cloudflare may set a technical security cookie (e.g. __cf_bm) to tell people from automated bots. You can delete or block any cookies in your browser settings.
7. How long we keep data
| Data | Period |
|---|---|
| Visit statistics | 14 months from the visit |
| Correspondence about an enquiry | up to 2 years from the last contact if no contract follows; with a contract, as long as the law requires |
| Cloudflare technical logs | under Cloudflare's terms (usually up to 30 days) |
When the period ends, the data is deleted or anonymised.
8. Who receives the data
We do not sell data or use it for advertising. It is processed only by these processors we engage, and only on our instructions:
- Cloudflare, Inc. — website hosting, delivery and protection;
- Google Ireland Limited — email services (Google Workspace).
We run the Umami statistics tool ourselves — that data goes to no third party. Data may be disclosed to law-enforcement or supervisory authorities where the law requires it.
9. Transfers outside the EEA
Cloudflare and Google may also process data outside the European Economic Area. Such transfers rely on the European Commission's standard contractual clauses (GDPR Art. 46(2)(c)) and the EU–U.S. Data Privacy Framework.
10. Your rights
You have the right:
- to access your data and get a copy;
- to have inaccurate data corrected;
- to have data deleted when it is no longer needed;
- to restrict processing;
- to object to processing based on legitimate interest, including visit statistics;
- to data portability where processing is based on a contract.
Because the statistics are anonymous and we keep no IP address, we usually cannot identify you in them (GDPR Art. 11), but you can always object to further processing.
Send your request to [email protected] or in writing to our registered office. Say which right you want to exercise and give information that lets us confirm your identity. We reply within one month; in complex cases this may be extended by two further months, and we will tell you if so.
If you believe we process data improperly, please contact us first. You also have the right to complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, [email protected], vdai.lrv.lt).
11. Changes to this policy
We update this policy when the website, our business or the law changes. The current version is always published on this page.