Who is responsible for your data. I, Rokas Stulga, am the data controller. I build websites in Lithuania as a sole trader registered under a Lithuanian individual activity certificate. For any question about your data, email r.stulga14@gmail.com.
What data I process, why and on what legal basis (the relevant point of Article 6(1) GDPR is given for each):
- Enquiries and quotes. Questionnaire answers and emails: first name and surname, business name, phone number, email address, information about your business and links to files. I need them to reply to you and prepare a quote. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b)). If you write as a company representative or employee, the basis is my legitimate interest in replying to a company that is asking about my services (Article 6(1)(f)).
- Work under a contract. Correspondence, the contract, the material you send me, and the names and email addresses of the users of your website’s admin panel. Legal basis: performance of the contract (Article 6(1)(b)). If the contract is with a company, I process its representatives’ and employees’ data on the basis of my legitimate interest in performing that contract (Article 6(1)(f)).
- Invoices and bookkeeping. The details I must put on an invoice: the company name and registration code, or your first name and surname; if you are a sole trader, your VAT number or, at your choice, your individual activity certificate number or personal identification number; if you are a business in another EU country, also your address and VAT number. Also the service, the amount and the payment details. Legal basis: a legal obligation under Lithuanian tax and accounting law (Article 6(1)(c)).
- Questions and disputes after the work. I keep our correspondence after the work is finished, so that I can answer questions about the work done and, if a dispute arises, defend my rights. Legal basis: legitimate interest (Article 6(1)(f)).
- Portfolio. I show the first screen and name of your finished website on my page only with your permission. Legal basis: consent (Article 6(1)(a)).
- Running and securing this website. When you open this page, the server automatically logs your IP address, the time, the request, and browser and device details. Legal basis: my legitimate interest in keeping the website running and protected from attacks (Article 6(1)(f)).
Do you have to provide your data? The law doesn’t oblige you to. But without your contact details I can’t reply or prepare a quote, and the law requires me to put certain details on an invoice, so without them I can’t enter into a contract with you or issue an invoice. The other questions in the questionnaire are optional: answer as many as you wish. If you give me other people’s details (for example, an employee who will manage the website), please let them know. When I first write to them, I will also say where I got their contact details and include a link to this notice.
Who else receives data.
- Google (Google Ireland Limited, Ireland). The questionnaire runs on Google Forms, and my email on Gmail. I use a personal Google account, so I have no data processing agreement with Google: Google processes this data under its own terms and privacy policy, not on my instructions. The questionnaire opens on Google’s website, so that policy and Google’s cookies also apply to you while you fill it in.
- Google Fonts. The fonts on this page are loaded from Google’s servers, so your browser sends Google your IP address, browser details and the address of this website. Google states that it does not use this data to build profiles or for advertising. Legal basis: my legitimate interest in the page looking as designed everywhere (Article 6(1)(f)).
- Hostinger (Hostinger International Ltd., Cyprus) hosts this website and processes the server logs on my behalf under a data processing agreement.
- The bank through which I receive payments, and the provider of my invoicing or bookkeeping software.
- The State Tax Inspectorate of Lithuania and other public authorities, only when and only as far as the law requires.
- If we talk via Messenger or Instagram (Meta) or on a video call, the provider of that service also processes data under its own rules.
I don’t sell data, and I don’t pass it on to anyone for advertising.
Artificial intelligence. I write code with the help of Claude (Anthropic), but I don’t put your personal data — names, contact details, emails — into it. When I write website copy from the questionnaire, I use only the information about your business.
Data outside the European Economic Area. Google may also process data in the United States. Google LLC takes part in the EU-U.S. Data Privacy Framework, and in Decision (EU) 2023/1795 the European Commission found that data transferred to such companies is adequately protected. Hostinger may also use sub-processors, including the US company Cloudflare, Inc.; such transfers are covered by the EU standard contractual clauses included in its data processing agreement.
How long I keep data.
- Enquiries that did not lead to a contract: 12 months from the last message. After that I delete them.
- Correspondence: while we work together (including maintenance) and for 3 years after the last job.
- Invoices and other accounting records: 10 years from the end of the year in which they were issued, as the law requires. I keep contracts for as long as the invoices related to them.
- Files sent for your website and copies of your website’s data: while we work together. When the work ends, I return or delete the files, as agreed. Attachments sent by email stay with the emails and are kept as long as the correspondence.
- Portfolio items: until you withdraw your permission.
- Server logs are collected automatically by Hostinger under its own rules. In my control panel I can see the entries for the last 7 days; I don’t download them or store them anywhere else.
Your rights. You can ask for access to your data, and ask me to correct it, erase it or restrict its processing. You can also receive the data you provided under a contract or on the basis of consent in a structured, commonly used and machine-readable format (the right to data portability). You can withdraw your consent to showing your website in my portfolio at any time with a single email — I will remove it within 7 days; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. I can’t erase invoices and accounting records before the retention period set by law has ended. Send requests by email. I will reply within one month at the latest; if a request is complex, I may extend this by two further months and will tell you so within the first month. On request, I will explain how I assessed my legitimate interest.
Right to object. Where I process data on the basis of legitimate interest (enquiries and work with company representatives, correspondence after the work, fonts and website logs), you can object at any time on grounds relating to your particular situation. I will then stop processing it, unless I have compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend legal claims.
Complaints. If you believe I process your data unlawfully, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI, L. Sapiegos g. 17, 10312 Vilnius, Lithuania, ada@ada.lt, vdai.lrv.lt) or with the supervisory authority in the EU or EEA country where you live or work. I’d be glad to sort it out myself first — just write to me.
Automated decisions. I don’t make automated decisions about you or create profiles. I prepare every quote and price myself.
When I build or maintain your website. I process its content (for example, photos showing people) and its visitors’ data (bookings, orders) on your behalf and only on your instructions: in that case you are the data controller and I am the data processor. We put these terms in our contract.
Cookies. This website sets no cookies, stores nothing in your browser and uses no visitor analytics or advertising tools. The questionnaire link opens a Google page, where Google’s cookie rules apply.
Updated 23 September 2026.
