Privacy policy

1. Data controller

The controller of the website manoobjektas.lt and the service provided on it is [FILL IN: company name], company code [FILL IN: code], registered office [FILL IN: address], email [FILL IN: email] ("we").

manoobjektas.lt is a BuildFlow.lt product. For any questions about personal data, write to the email address above.

2. What data we process

We process only the data needed to provide the service and run the website.

• Account data: name, surname, email address, phone number, company name and details, logo, password hash (we do not store the password itself).
• Client contacts entered by the contractor: the client's name, phone number, email address, job site address.
• Estimate and job site content: work lists, quantities, prices, photos, approval date and time, payment records, comments.
• Subscription and billing data: chosen plan, invoice details, payment status. We do not store card numbers – they are handled by the payment provider.
• Technical data: IP address, browser and device type, login time, error logs, security events.
• Cookies and similar technologies – see the Cookie policy.

3. Purposes and legal bases

• Creating the account, providing the service, sending estimates to clients, support – performance of a contract (GDPR Art. 6(1)(b)).
• Issuing invoices and accounting – legal obligation (GDPR Art. 6(1)(c)).
• Website security, fraud prevention, bug fixing, technical logs – legitimate interest (GDPR Art. 6(1)(f)).
• Analytics and marketing cookies – your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
• Newsletters about product updates – consent, which you can withdraw via the link in every email.

4. The contractor as controller of their clients' data

When a contractor enters their clients' data (name, phone, email, job site address) into manoobjektas.lt and sends them estimates, the contractor is the controller of that data and we are the processor acting on the contractor's instructions.

The contractor is responsible for having a lawful basis to process their clients' data and for informing clients about it. We process this data only to provide the service, never pass it to third parties for our own purposes, and delete it when the contractor deletes the account or the data.

The processing terms (subject matter, duration, nature, purpose, security measures, use of sub-processors) are part of the Terms of use and together form a data processing agreement under GDPR Article 28.

5. How long we keep data

• Account, job site and estimate data – while the account is active. After the account is deleted, data is erased within 30 days unless we must keep it by law.
• Accounting documents (invoices) – 10 years under Lithuanian accounting rules.
• Technical logs and security events – up to 12 months.
• Cookie choice – 12 months, then we ask again.
• Support correspondence – 2 years from the last message.

6. Who we share data with

Data is processed by the following service providers (processors) under data processing agreements:

We may also disclose data to public authorities where the law requires it, and to legal advisers in the event of a dispute. We do not sell or rent data.

7. Transfers outside the EU/EEA

We store data in the European Union. If any processor transfers data outside the EU/EEA, this happens only under a European Commission adequacy decision or standard contractual clauses (GDPR Art. 46).

8. How we protect data

• All data travels over an encrypted connection (TLS).
• Access to job sites and estimates is restricted at row level: a job site is visible only to the contractor, the workers they invite and the client via the link.
• Passwords are stored only as hashes.
• Only authorised people have server access, and access is logged.
• If a data breach is likely to put your rights at risk, we will notify you and the State Data Protection Inspectorate within 72 hours.

9. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• have your data erased ("right to be forgotten");
• restrict processing;
• receive your data in a structured format and transfer it to another controller;
• object to processing based on legitimate interest;
• withdraw consent at any time – this does not affect the lawfulness of processing before withdrawal.

Send requests to [FILL IN: email]. We reply within 30 days at the latest. We may ask you to confirm your identity.

If you believe your data is handled improperly, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, vdai.lrv.lt).

10. Cookies

Which cookies we use, how long they last and how to manage them is described in a separate document – the Cookie policy.

11. Age

The service is intended for businesses and people aged 18 or over. We do not knowingly collect children's data. If we learn that we have received such data, we will delete it.

12. Changes to this policy

We may update this policy. We will announce material changes by email or in the account at least 14 days in advance. The current version is always published on this page with the update date.

13. Contact

[FILL IN: company name], [FILL IN: address], email [FILL IN: email].