Privacy notice

1. Data controller

The controller is Inovacijų dialogas, MB, a Lithuanian small partnership, legal-entity code 306672068, VAT LT100016637613, Vilnius, Lithuania.

For any data-protection question, use the inquiry form on this site — say that your question concerns personal data and we will reply via the contact you leave in the form. We have no data protection officer — we are not required to appoint one, because we do not process personal data on a large scale.

The same company — Inovacijų dialogas, MB — also runs the bookkeeping service vedu.lt, which has its own privacy notice. This notice covers the konturas.lt site and the e-mails and calls Kontūras makes to companies.

2. What we collect

Through the inquiry form we collect your name, e-mail address, the service areas you select and an optional message. Through the free website check form we collect only the website's address and the e-mail address we send the report to. Neither form has just-in-case fields.

Alongside an inquiry or check request we store only two technical values in the database: the country code and the address of the page you arrived from. We do not store your IP address or browser identifier (user agent) — the IP is used briefly to protect the form from automated submissions (Cloudflare Turnstile) and to rate-limit inquiries, and the user agent leaves the server on its way to Meta and OpenAI (the full list of recipients is in section 5).

While you browse the site we collect nothing further until you have given consent in the cookie banner. Once you do, the analytics and advertising tools collect page views, IP address, browser identifier and the other data listed in sections 5 and 7; the cookies are described in section 6.

Section 8 describes the data we hold about companies we e-mail or call.

We do not collect special categories of data (health, beliefs and the like), and we ask you not to enter such data in the message field.

3. Purposes and legal basis

Handling your inquiry, preparing a quote and preparing a free website check — steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)). You submit the data yourself when asking for a quote or a check.

Site and form security, bot protection and rate limiting — legitimate interest (GDPR Art. 6(1)(f)). Application error logging rests on the same basis.

E-mails and calls to companies offering our services — legitimate interest (GDPR Art. 6(1)(f)); section 8 gives the details.

Visit analytics and ad conversion measurement — only with your consent (GDPR Art. 6(1)(a)), given in the cookie banner. You can withdraw consent at any time; withdrawal does not affect processing carried out beforehand.

We carry out no automated decision-making or profiling within the meaning of GDPR Art. 22 — every inquiry is reviewed by a person. We do not sell data.

4. How long we keep it

If no project follows, we keep the data from inquiries and check requests for up to 24 months from the last exchange and then delete it.

If a contract is concluded, further processing rests on that contract, and accounting documents are kept for the period the law requires.

Error-log entries are kept for up to 90 days. Retention of data sent to the advertising and analytics recipients is set by those recipients and stated in their own privacy policies.

Section 8 sets out how long we keep data about companies we e-mail or call, and the opt-out list.

5. Who receives the data

The following providers help us process the data. Most of them are processors acting on our instructions. The ad networks (Meta, Google, OpenAI) are the exception: they process what they receive as independent controllers, for their own purposes.

Data reaches the ad networks only after marketing consent. The e-mail address is hashed (SHA-256) before sending — we never send it unhashed; IP address and browser identifier are sent in the clear, because these interfaces do not accept hashed values for those fields. The site's form collects no phone number, so none is sent.

On OpenAI: the contract is with OpenAI Ireland Limited, registered in Ireland — under the OpenAI Ad Tools Data Processing Addendum (19 August 2026 edition) it is the entity that processes EEA data. Any onward transfer outside the EEA is made by OpenAI itself, which undertakes to use a valid transfer mechanism but does not name which one — Standard Contractual Clauses (SCCs) or the EU-U.S. DPF — in that addendum. Until OpenAI publishes it, we name no specific mechanism here. In the same addendum OpenAI reserves the right to use what it receives to develop, provide and improve its own and its affiliates' products and services, not only to measure our advertising.

We may also disclose data to law-enforcement or supervisory authorities where the law requires it.

6. Cookies

Essential cookies are always set — the site would not work without them. Analytics and marketing cookies are switched on only after you agree in the cookie banner; until then they are not set.

You can change your choice at any time via "Cookie settings" at the bottom of the site. After withdrawal no new cookies are written, but existing ones remain until the expiry shown in the table — to remove them immediately, use your browser settings.

Third-party cookies are controlled by the respective companies. Their privacy policies:

• policies.google.com/privacy
• facebook.com/privacy/policy
• openai.com/policies/eu-privacy-policy
• cloudflare.com/privacypolicy

7. Your rights

You have the right to access the data we hold, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Exercising these rights is free of charge; we reply within the deadlines the GDPR sets.

You can object to our e-mails and calls to companies at any time: replying "nerašykite" ("don't write") is enough. Section 8 describes the other ways, and how an objection differs from replying "ne" ("no").

One limit we will not hide: once you give marketing consent, some of the data has already been sent. To Meta — a hashed e-mail address, a hashed country code, the IP address, the browser identifier, the address of the page you arrived from, which form you used and, for the inquiry form, the service areas you selected. To OpenAI — a hashed e-mail address, the IP address, the browser identifier, the address of the page you arrived from and the oppref click reference; which form you used and what you selected in it are not sent to it. To Google (Google Ads) — for every page you open: its address and title, the address of the page you arrived from, the IP address, the browser identifier, the identifiers stored in the _gcl_au cookie and the _gcl_ls browser-storage entry, the cookies your browser holds for Google's domains and, if you arrived by clicking a Google ad, the identifier of that click and its technical data (such as the ad network). When you send an inquiry or check request, Google Ads also receives an internal inquiry number and the screen size. We cannot recall that transmission: the data sits in those companies' systems, and we have no means of deleting it from there. On receiving an erasure request we stop sending further events to Meta and OpenAI immediately and pass the request to their own deletion tooling (the deletion itself is carried out by them), and if no more than 54 days have passed since your inquiry or check request, we retract the conversion linked to it in Google Ads — it is no longer counted. Even once the conversion is retracted, the data Google Ads has already received stays in Google's systems, so for its erasure contact Google directly; to stop Google Ads receiving further data, withdraw your marketing consent via "Cookie settings" at the bottom of the site. We instruct Google not to use the Google Ads data for personalised advertising, such as remarketing. We send no e-mail address or phone number to Google Analytics 4 or Google Ads.

Google Analytics 4 events are sent only on analytics consent. One further limit: the browser downloads the Google tag file itself on either consent — analytics or marketing — so already at that point Google receives your IP address, your browser identifier and the address of the page you are on.

Providing the data is voluntary. Without a name and an e-mail address we cannot accept an inquiry or prepare a quote, and without a website and an e-mail address we cannot carry out a free check. There is no other consequence.

If you believe we are mishandling your data, you have the right to lodge a complaint with the State Data Protection Inspectorate (VDAI), Lithuania's data-protection authority — vdai.lrv.lt.

8. E-mails and calls to companies

We e-mail and call companies to offer our services: usually to fix a specific problem we noticed on their website (for example, a page that loads slowly, is awkward to use on a phone, or has a contact form that does not work), or to build a website if the company has none.

We take company data from public sources: the company's own website, business directories (for example rekvizitai.vz.lt, 1551.lt, visalietuva.lt, geltoni.lt), the company database okredo.com, Google Maps and the company's Facebook page. We never guess e-mail addresses and never buy contact lists. We collect nothing from you before the e-mail or call.

For a company we e-mail or call, we hold: its name, company code, the e-mail address and phone number the company published itself, the director's name if it is public, and publicly visible facts about its website (how fast it loads, whether it is easy to use on a phone, whether the contact form works). We also keep a record of what we sent and when, when we called, and your reply.

We e-mail and call legal persons (UAB, MB, VšĮ, AB) at contacts the company has itself published on its website, in business directories, on Google Maps or on its Facebook page. Such a contact may also be an e-mail address made up of the owner's or director's first name and surname (for example [email protected]), if the company itself published it. We do not e-mail or call sole traders or farmers. We use these contacts to send the company one business offer and for no other purpose. If you do not reply, we may send one reminder after a few working days.

The legal basis is legitimate interest in offering services to business customers (GDPR Art. 6(1)(f)). We rely on what the company itself has published and offer website-related services.

Our e-mails come from a konturas.lt e-mail address. Every e-mail says who we are, where we got your address and the company data, and how to stop further e-mails.

The first call is made by an automated voice assistant, which identifies itself at the start of the call and says why it is calling. If you do not wish to continue, the call ends there. If you agree to talk further, a person takes over the conversation.

If you do not reply and are not interested, we delete the company data and the records of our e-mails and calls no later than 12 months after the last e-mail or call. If you reply and are interested in our services, we then handle it as inquiry data (see sections 3 and 4).

If you reply to an e-mail or call with "ne" ("no"), "neaktualu" ("not relevant"), "jau turime" ("we already have one") or similar, we take it that the Kontūras offer is of no interest to your company, and we stop calling and e-mailing you about it.

You have the right to object to this processing at any time (GDPR Art. 21). It is enough to reply "nerašykite" ("don't write"), "neskambinkite" ("don't call"), "išbraukite" ("remove us") or otherwise ask us not to contact you again, to say so during a call, or to write to us through the inquiry form on this site. An objection takes effect immediately. The controller is a single company, Inovacijų dialogas, MB, so such an objection stops all of its direct marketing to your company: it no longer offers your company any of its services, by e-mail or by phone.

Opt-outs received before this version took effect on 28 September 2026 continue to apply to the whole company, including replies of "ne" to e-mails that promised we would neither write nor call again. The opt-out list holds the e-mail address or phone number, the company code if we know it, and when and how you opted out. We keep it indefinitely, because that is its purpose: the contacts stay on it so that your opt-out is respected in future too.

9. Version

This is the eighth version of this notice (v8), in effect from 28 September 2026. Opt-outs are no longer linked with Vedu (vedu.lt): in section 1 we have removed the sentence saying that an opt-out covers both brands, and in section 8 the paragraph on a shared opt-out list. Section 8 now distinguishes two cases: a reply of "ne" ("no") means the Kontūras offer is of no interest to your company, while a request not to be contacted again is an objection under GDPR Art. 21 that stops all of Inovacijų dialogas, MB's direct marketing to your company. It also says that opt-outs received before this version continue to apply to the whole company, and the purpose of the opt-out list is now worded to fit both cases. In section 7 the example of an objection is now "nerašykite" ("don't write") instead of "no". The note on the sixth version now describes the link with Vedu in our own words rather than quoting the removed sentence.

In the seventh version (v7), in effect from 27 September 2026, we added the business directories 1551.lt, visalietuva.lt and geltoni.lt and the company's Facebook page to the list of sources in section 8. We also made clear which contacts we e-mail and call: contacts the company has itself published, including an e-mail address made up of the owner's or director's first name and surname. Section 8 had previously ruled out personal contacts altogether. We stated that we send the offer once and, if the company does not reply, may send one reminder.

In the sixth version (v6), in effect from 27 September 2026, we added a new section 8, "E-mails and calls to companies": it describes what data we hold about companies we e-mail or call, where it comes from, whom we e-mail and call, that the first call is made by an automated voice assistant, on what legal basis, how long we keep the data, how to object, and that the opt-out list is shared with Vedu (vedu.lt). The former section 8, "Version", is now section 9. The introduction, section 1 and the page description now say that the notice also covers e-mails and calls to companies. Section 1 no longer calls Vedu a separate line of business and says that an opt-out covers both brands. Sections 2, 3, 4 and 7 now point to section 8. In the section 5 table, the Hostinger row now also names mailboxes, and we have added Google (Gmail, Google Sheets): the mailbox through which we send our e-mails to companies and receive the replies, and to which inquiry notifications are forwarded, and the spreadsheet holding the list of companies. Inquiry notifications were forwarded to Gmail under earlier versions too, but the table did not say so.

In the fifth version (v5), in effect from 25 September 2026, we removed the provisos that Google Ads is not yet switched on. The Google row in section 5 previously named an internal inquiry number, the IP address and the browser identifier, and section 7 the same data, saying only in general terms that Google Ads receives information about every page you open. Both sections now also list the other data Google Ads receives: the addresses and titles of the pages, the address of the page you arrived from, the identifiers stored in the _gcl_au cookie and the _gcl_ls browser-storage entry, the cookies your browser holds for Google's domains, the ad click identifier with its technical data, and the screen size. Section 7 now additionally says that we instruct Google not to use this data for personalised advertising, that what Google receives cannot be recalled either, and that withdrawing marketing consent stops further sending. It also says that on an erasure request we retract the matching conversion in Google Ads if no more than 54 days have passed since the inquiry or check request. The data Google Ads has already received stays in Google's systems even then, so its erasure must be requested from Google directly. As before, we pass erasure requests on to Meta and OpenAI.

In the section 6 table we have removed the note that the _gcl_au cookie is set only once Google Ads is switched on, and added the Google tag's entries _gcl_aw, _gcl_gb, _gcl_ag, _gcl_gs and _gcl_ls and Google's GCL_AW_P cookie. The Google tag already stored the first five in the browsers of visitors who gave marketing consent, but the table did not list them. The konturas_cids description now says that we neither use nor pass on the Google references stored in it. Section 7 now says that we send no e-mail address or phone number to Google Analytics 4 either (it previously said so only for Google Ads). Section 2 now says that the other data the analytics and advertising tools collect is listed in sections 5 and 7.

The consent cookie is now called konturas_consent_v3 (previously konturas_consent_v2), so the cookie banner is shown again and we ask for your consent afresh: consent given earlier no longer applies, because it was given under an earlier edition of this notice that did not list all the marketing cookies and all the data Google receives that are now named, and your consent must be clearly tied to the advertising networks and marketing cookies listed in this revision. At the same time the ChatGPT Ads click reference oppref is removed from the konturas_cids cookie, if it is stored there. Google click identifiers remain until they expire: we do not use them in the konturas_cids cookie, and the Google tag reads its own entries only with marketing consent.

Version 7 was in effect from 27 to 28 September 2026, version 6 for one day, 27 September 2026, version 5 from 25 to 27 September 2026, version 4 from 24 to 25 September 2026, version 3 for one day, 24 September 2026, version 2 from 4 September 2026, version 1 from 3 September 2026. Changes are recorded in the site's git history, so every earlier revision can be traced. Whenever the notice changes, the updated version is published on this page.