Privacy policy

1. Data controller

The controller of your personal data is D 14, MB (a small partnership, company code 308115071, VAT code LT100020749413, registered office at Didžioji g. 14-1, LT-01128 Vilnius, Lithuania), director Džiuginta Balčiūnė (“D14.”, “we”).

E-mail info@d14vilnius.lt, telephone +370 5 241 6817, address Didžioji g. 14-1, LT-01128 Vilnius, Lithuania.

This policy applies to the website d14vilnius.lt and the client portal d14vilnius.lt/klientas (the “Portal”).

2. What data we process

• Contact form data: name, e-mail address, telephone number (if provided) and the message.
• Portal account data: e-mail address and password. The password is stored only in encrypted form.
• Company and director details provided in the application.
• Know-your-customer data: origin of funds, beneficial owner details, and whether a person is a politically exposed person.
• Uploaded documents: the director’s identity document, the beneficial owners declaration and other documents.
• Contract and payment data: the contract, signature data from the Portal, invoices and payment information.
• Technical data: login session data stored in your browser, and the IP address and browser information processed by our hosting provider for security purposes.

3. Purposes and legal bases

We process data on the basis of Article 6(1) of the General Data Protection Regulation (GDPR):

• To conclude and perform a contract (point b): managing your account, reviewing the application, signing the contract, providing the services and issuing invoices.
• To comply with a legal obligation (point c): identifying the client and beneficial owners under the Law on the Prevention of Money Laundering and Terrorist Financing, and retaining accounting records under accounting legislation.
• Legitimate interest (point f): responding to enquiries, keeping the website and Portal secure, and defending our rights.
• Consent (point a): direct marketing. We do not currently send marketing messages. If we start, we will ask for separate consent.

Providing know-your-customer data is mandatory. Without it we cannot conclude a contract or provide the services.

If you provide data about other people, such as the director or beneficial owners, you must ensure that you are entitled to provide it and that those people have been informed.

We do not make automated decisions, including profiling, that produce legal effects for you.

4. Retention periods

• Enquiries are kept for up to 2 years unless they lead to a contract.
• Know-your-customer data and documents are kept for the period required by law, currently 8 years after the end of the business relationship.
• Invoices and other accounting records are kept for 10 years under accounting legislation.
• Other contract and account data is kept for as long as the contract is in force and afterwards for as long as necessary to bring or defend legal claims, but no longer than the law permits.

When the retention period ends, data is deleted or anonymised.

5. Recipients and processors

Data is accessed only by authorised D14. staff. We also use the following processors:

• Supabase: database, login and file storage. Servers are located in Germany (EU).
• Cloudflare: hosting of the website and Portal, content delivery network and security.
• Resend: sending of automatic e-mails. The EU region (Ireland) is used.
• Google Workspace: company e-mail.

We disclose data to public authorities where required by law.

Legal services are provided by WIDEN Legal under its own contract with you. Data you provide to WIDEN Legal is processed by it as an independent controller.

6. Transfers outside the EU

Data is stored in the European Union. If a processor transfers data outside the European Economic Area, this is done only under the Standard Contractual Clauses approved by the European Commission.

7. Your rights

Under the GDPR you have the right to:

• access your data;
• have inaccurate data rectified;
• have your data erased;
• restrict the processing of your data;
• receive your data and transfer it to another controller;
• object to processing based on legitimate interest;
• withdraw your consent at any time.

Some rights may be limited where we are required by law to retain data, for example know-your-customer or accounting data.

Please send requests to info@d14vilnius.lt. We respond within 1 month. In cases provided for by the GDPR this period may be extended, and we will inform you if it is.

8. Complaints

If you believe your data is processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt). We ask that you contact us first so that we can try to resolve the issue.

9. Security, cookies and further information

The security measures we apply and a more detailed description of data processing in the Portal are given in the Data processing document. Information about data stored in your browser is given on the Cookies page.

10. Changes to this policy

We may update this policy. The current version is published on this page together with the date of the last update.