Privacy Policy

Effective 27 September 2026 · Version 1.0

1. Controller

The controller of your personal data is Algirdas Urbonas, self-employed under individual activity certificate No. 735224, VAT number LT100015467415, Žalgirio g. 90, Building D, Office 622 (Regus), Vilnius, Lithuania. Email info@algirdasurbonas.lt, phone +370 636 88 454.

This policy explains how I handle personal data when you visit algirdasurbonas.lt, send an enquiry or order services. I comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Lithuanian Law on the Legal Protection of Personal Data.

2. Data I process

• Contact details: name, email address, phone number and, if you act for a company, its name and your role.
• Enquiry and order data: your message, the documents you send and their translations, the requested deadline, and our correspondence.
• Billing data: the details needed for a VAT invoice, and payment records.
• Technical data: IP address, browser type, time of request and other server log entries recorded automatically by the website host.

You do not have to provide any data, but without contact details and documents I cannot reply to your enquiry or translate, and the details on a VAT invoice are required by law.

3. Purposes and legal bases

• Replying to your enquiry and preparing a quote: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• Providing the services you order and corresponding with you about them, to perform the contract (Article 6(1)(b) GDPR).
• Invoicing, bookkeeping and keeping accounting records, as the law requires (Article 6(1)(c) GDPR).
• Running the website and keeping it secure, dealing with business clients' representatives and, if needed, establishing, exercising or defending legal claims, on the basis of my legitimate interests (Article 6(1)(f) GDPR).

I do not make decisions based solely on automated processing, including profiling.

4. Data in your documents

Documents for translation often contain other people's personal data. When a company or organisation orders the services, I process that data on the client's behalf and in accordance with its instructions. I am then a processor and the client is the controller. Where the client itself processes the data for another controller (for example, a translation agency), I act as its sub-processor. Our relationship is governed by the Data Processing Agreement published on this website, unless we have signed a different one.

When a private individual orders the services, I am the controller of the data in their documents, including data about other people (for example, family members), and use it only to provide the service. The client confirms that they are entitled to submit the documents for translation.

The documents you send may contain special categories of your personal data, such as health data. I process such data only to produce the translation, on the basis of your explicit consent, given by ticking the optional box on the website form or in writing (Article 9(2)(a) GDPR). Where relevant, the basis is also the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR).

5. Recipients

• Netlify, Inc. (USA), the website host. Information submitted through the website form and uploaded files are stored on Netlify's servers until I move them to my mailbox (Section 7). Netlify may use its own sub-processors, for example to check data received through the form for spam.
• Google Cloud EMEA Limited (Ireland), the email provider (Google Workspace). Correspondence is kept only in my Google Workspace mailbox.
• Providers of language technology tools (translation memory software, machine translation, AI assistants). I use only tools whose providers do not use the submitted data to train models and keep it confidential. I process documents containing personal data only with tools whose providers have entered into a data processing agreement with me.
• Partners – translation agencies or translators – only when a specific order requires them, and documents containing personal data only with your consent. Before receiving any material, they give a written confidentiality undertaking, and partners who process personal data are bound by the same data protection obligations as those in my data processing agreement.
• My accountant, for the data needed for bookkeeping.
• Public authorities, only where the law requires.

I do not upload your documents to publicly available services that use input to train their models. You may prohibit language technology tools for a specific order.

6. Transfers outside the EEA

Netlify, Google and some language technology providers (for example, Anthropic) may process data outside the European Economic Area, including in the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified, or on the standard contractual clauses approved by the European Commission. Write to me for details of the safeguards.

7. Retention

• Enquiries that did not lead to an order: attachments are deleted within 3 months; the correspondence is kept for up to 12 months.
• Data received through the website form: I move it to my mailbox and delete it from Netlify at least once a month.
• Source documents and translations: kept for up to 12 months after delivery, so that I can answer questions and correct errors. I then delete them, unless you ask for earlier deletion or we agree on longer storage.
• Accounting records: kept for the period required by law (10 years).
• Server logs: kept by the host for its own retention period.

Personal data does not remain in translation memories or glossaries for more than 12 months after delivery: I remove or anonymise it by then, or sooner on request.

8. Security

The website and email use encrypted connections. Access is restricted: partners and my accountant receive only what they need for their work. Accounts holding data are protected by two-factor authentication.

9. Your rights

You have the right to:

• access your data and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict processing;
• receive the data you provided in a machine-readable format and pass it to another controller;
• object to processing based on my legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting earlier processing.

These rights are not absolute. For example, I cannot delete accounting records before the law allows.

To exercise your rights, email info@algirdasurbonas.lt. I reply within one month of receiving your request. The GDPR allows this period to be extended for complex requests; if so, I will tell you within the first month. I may ask you to confirm your identity.

If I process your data as a processor for a business client, please contact that company. I will forward any request sent to me.

10. Complaints

If you believe I process your data unlawfully, you can contact me. You may also complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, www.vdai.lrv.lt).

11. Cookies

This website does not use cookies. It has no cookie-based analytics and no advertising trackers, so it does not ask for cookie consent.

12. Changes

I update this policy when my business, the services I use or the law change. The current version and its effective date are published on this page. Ordering is governed by the Terms of Service.