Privacy Policy

1. Who We Are and How to Contact Us

1.1. The controller is Majevski, MB, legal entity code 304720404, registered office address Smalinės g. 21-3, LT-06225, Vilnius, Lietuva. Data about us is collected and stored in the Register of Legal Entities of the Republic of Lithuania.

1.2. For questions about the processing of personal data and the exercise of your rights, write to us by email at pagalba@majevski.com. You may write in any language of the Service; we reply in Lithuanian or English and, where possible, also in your language.

1.3. We have not appointed a data protection officer. For all data protection matters, contact us at the email address given in clause 1.2.

1.4. This policy applies to: 1) Customers who are natural persons, representatives of Customers, Users and payers (Section 3); 2) Clients, to the extent that we process their data ourselves: for the purposes of the DEK Identity, the combined Reliability Score and protection against abuse (Section 4); 3) visitors to the website and Booking Pages and other persons who contact us (Section 5). Recipients of data, transfers, retention periods, automated decisions, security and rights are described in Sections 6 to 13 and apply to everyone.

2. Who Is Responsible for Which Data

2.1. The Customer, that is, the business that uses the Service (for example, a salon, a clinic or a consultant), is the controller of Client Data and of the data of Team Members processed in the Service. It decides what data about Clients to collect, what messages to send and how long to keep the data. We process this data as a processor, only on the Customer's behalf and on its instructions, as set out in the Data Processing Agreement (the "DPA") (clause 21.1 of the Terms).

2.2. Client Data includes, for example, the Client's name, contact details, visits, notes, custom field values, consent flags, SMS conversations and message history. How the business processes this data is explained in its privacy notice (clause 11.4 of the Terms). Contact the business about this data and your rights in respect of it. The same applies to persons who are not Clients but send SMS messages to a business's SMS Gateway number or receive messages from it: the business processes such messages as a controller (clause 14.7 of the Terms). If such a request is made to us and it can be determined from it which business it is intended for, we forward it to the business without undue delay and ask you to contact the business (clause 3.3 of the Terms).

2.3. We are an independent controller in respect of the following data: 1) account, login and billing data of Customers, Users and payers; 2) DEK Identity data; 3) the combined Reliability Score across several businesses; 4) anti-abuse data, including the M Blacklist database; 5) technical and security logs; 6) records of acceptance of the Terms and the DPA and records of the Operator's logins to Accounts; 7) cookie consents and analytics data of visitors to the website and Booking Pages; 8) aggregated statistics and Customers' usage metrics of the Service; 9) data relating to enquiries, the waiting list, the referral programme and the demo account (clauses 3.7, 17.4, 17.5, 21.2, 21.4, 21.5 and 21.6 of the Terms).

2.4. The same function of the Service may be used both on a business's behalf and for our own purposes; in that case, the role stated for each purpose applies to that purpose. For example, we calculate a Client's Reliability Score in one business's Account on that business's behalf, while we process the combined score across several businesses as an independent controller.

2.5. The Sub-processors we engage are listed in the DPA. Calendar services in which Team Members subscribe to Calendar Links, and other services chosen by the Customer that it uses under separate agreements with their providers, receive data on the Customer's instruction and process it under their own terms; their providers are not our Sub-processors (clauses 7.4 and 18.2 of the Terms). We ourselves provide the SMS gateway service asms.lt under a separate agreement with the Customer (clauses 7.8 and 14.2 of the Terms): we process the data in the Customer's asms.lt account on the Customer's behalf, and the Service uses that account only on the Customer's instruction.

3. Data of Customers, Users and Payers

3.1. Account creation and the Agreement. When you create an Account, we process the business name, your name, email address, phone number, if you provide it, and a hash value of your password (we do not store the password itself). This data is also used to create the Owner's Team Member record in the Account. By default, the phone number provided is also recorded as the phone number of the business and of its branch, and the business's phone number is shown publicly on the Booking Page; your name is shown on the Booking Page as the name of a Team Member with whom a visit can be booked. You can change or hide this data in the settings of the Service. Where this is necessary to perform the Agreement or to issue an invoice, we also process the Customer's legal name, country of establishment, legal entity code or the number of its individual activity certificate or business certificate, VAT identification number, if one has been assigned, and address (clause 4.4 of the Terms). Purposes: to conclude and perform the Agreement, to identify the Customer and its representative and, where necessary, to check whether the restrictions referred to in clause 4.7 of the Terms apply to the Customer. Legal bases: entering into and performing a contract where the Customer is a natural person (Article 6(1)(b) GDPR); where the Account is created on behalf of a legal person, our legitimate interest in concluding and performing the Agreement with the Customer and in communicating with its representative (Article 6(1)(f) GDPR); as regards compliance with sanctions, a legal obligation (Article 6(1)(c) GDPR). You provide the data; we may verify the Customer's details in public registers. Providing the business name, name, email address and password is mandatory: without them an Account cannot be created. The phone number is optional. The Customer is required under the Agreement to provide the data referred to in clause 4.4 of the Terms; if this data is not provided, we may refuse to allow a paid Plan to be ordered, restrict the Service or terminate the Agreement.

3.2. User logins. Logins of other Users (for example, with the Manager, Reception or Staff role) are created by the Customer: its User enters the person's name, email address, password, role and, where applicable, branch. The source of this data is therefore the Customer, not the User themselves. We also process the User's language, start page, setting for notifications of new bookings and time of last login (which is also updated when a person authorised by the Operator logs in with that User's rights). A User can add a photo of themselves in their settings: it is shown only inside the Service (not on Booking Pages), and the User can replace or delete it there. Purpose: to provide the access ordered by the Customer and to ensure that it works. Legal basis: our legitimate interest in providing the Customer with the Service it has ordered and access for its Users (Article 6(1)(f) GDPR).

3.3. Login and Account security. We process login sessions, "remember me" tokens (we store only their hash values), password reset requests (the email address and a hash value of the link), the number of failed attempts by IP address and by hash value of the email address, and security log entries about logins, logouts, failed attempts, lockouts and password resets, which contain the IP address and, in some cases, also the email address. After 5 failed attempts within 15 minutes, login is temporarily blocked. Legal basis: our legitimate interest in ensuring the security of the Service, of Accounts and of the data in them (Article 6(1)(f) GDPR). Logins are also subject to the protective measures described in clauses 4.12 and 4.13.

3.4. Payments through Stripe. When a paid Plan is ordered, we transfer to Stripe the Owner's email address, the business name, the Account identifier, the Plan and the number of Billable Units. You enter payment card details only on Stripe's pages; we neither receive nor store them (clause 9.2 of the Terms). We receive notifications from Stripe about payments and the status of the subscription; they may contain the payer's name, email address, phone number, address and VAT identification number, if these were provided to Stripe. If a payment fails, we notify the Owner by email. Legal bases: entering into and performing a contract where the Customer or the payer is a natural person (Article 6(1)(b) GDPR); in other cases, our legitimate interest in performing the Agreement with the Customer; the storage of Stripe notifications is based on our legitimate interest in verifying payments and resolving disputes about them (Article 6(1)(f) GDPR).

3.5. Invoices. When we issue an invoice (for example, under a separate agreement), we state in it the buyer's name, identification code, VAT identification number, address, country and email address. Legal basis: the legal obligation to prepare and keep accounting documents (Article 6(1)(c) GDPR; the Law on Financial Accounting of the Republic of Lithuania and the Law on Documents and Archives of the Republic of Lithuania). We cannot issue an invoice without this data.

3.6. Referrals. The "Powered by DEK" link at the bottom of Booking Pages indicates from which business's page you came. If a person who came through it signs up for the waiting list, we record which business referred them; if an Account is later created with the same email address, this record is transferred to the Account so that, when the new Customer orders a paid Plan for the first time, the referring business receives free days of the Service. If an Account is created directly, without an earlier sign-up for the waiting list, the referring business is not recorded. Legal basis: our legitimate interest in running the referral programme (Article 6(1)(f) GDPR).

3.7. Notices to Owners and Users. We send notices relating to the Service and the Agreement: password reset links, warnings of failed payments, notices of the Operator's logins to the Account and of amendments to the Terms, daily, weekly and monthly digests to the Owner, warnings to the Owner that 80% or all of the month's "Premium SMS" messages have been used, and notifications of new bookings to those Users with the Reception role who have enabled them. Notices relating to the performance of the Agreement cannot be opted out of (clause 32.1 of the Terms); digests and notifications of new bookings can be switched off in the settings of the Service. Legal bases: performance of a contract where the Customer is a natural person (Article 6(1)(b) GDPR); in other cases, including where notices are sent to Users, our legitimate interest in providing information about the operation of the Service and the performance of the Agreement (Article 6(1)(f) GDPR). We process the Client Data contained in digests and in notifications of new bookings on the business's behalf under the DPA.

3.8. Operator access and administration. Persons authorised by the Operator may log in to an Account with the rights of a User for the purposes referred to in clause 21.5 of the Terms. They then process the Client Data in the Account on the business's behalf under the DPA, while we process the records described in this clause as a controller. A record is created for each login: the purpose and an explanation, with the rights of which User the login was made, whether the login was made at the Customer's request, the start of the login, the time of the last action and, where the administrator ends the login or logs out, the end of the login, the Operator's administrator account used, and the IP address and browser data of the administrator who logged in. The Owner is notified by email of any login not made at the Customer's request, except in the cases referred to in clause 21.5 of the Terms. For the performance of the Agreement and for the other purposes referred to in clause 21.5 of the Terms, persons authorised by the Operator may process Account data using administration tools or directly in the database without logging in to the Account; such actions are not recorded in the manner described in this clause and no notice is given of them. When administering the Agreement, we also process the Plan, restrictions, reasons for suspension and internal notes about the Customer. Legal bases: performance of a contract where support is provided at the Customer's request; our legitimate interest in correcting errors, ensuring security and proving how access was used; a legal obligation where a login is necessary to comply with legal requirements (Article 6(1)(b), (c) and (f) GDPR).

3.9. Records of acceptance of the Terms and the DPA. When an Account is created or the Owner confirms the Terms in the Service, we record who accepted the Terms and the DPA (name and email address), when, which versions of them, in which language, the checksums of their texts, the method of acceptance, the IP address and browser data. Legal basis: our legitimate interest in proving the conclusion of the Agreement and its terms and in defending legal claims (Article 6(1)(f) GDPR; clause 1.5 of the Terms).

3.10. Statistics and usage metrics. We prepare aggregated statistics (for example, the total number of businesses, Clients, visits and reminders sent) and may publish them on the website. For each Customer, without cookies or IP addresses, we count Booking Page views and bookings started and completed per day, and we also use the time of last login and which functions are enabled. These metrics are personal data to the extent that they relate to a Customer who is a natural person, and the time of last login is always personal data of a User. Legal basis: our legitimate interest in providing, maintaining and improving the Service (Article 6(1)(f) GDPR; clause 21.4 of the Terms).

3.11. Waiting list. When sign-ups for the Service are closed, it is possible to sign up for the waiting list on the website. We then process the email address, name, business name and type, phone number, language, where you came from (including the referring business) and the IP address. Legal basis: our legitimate interest in contacting persons who wished to use the Service (Article 6(1)(f) GDPR).

3.12. Signing in with a Google account. An Account can also be signed in to with a Google account, and an Owner can create an Account with one. We then receive from Google your Google account identifier, your first name and surname, your email address, the link to your Google profile picture and Google's confirmation that the email address is yours, and Google learns that you sign in to the Service. We link the Google account to the User login whose email address is the one Google confirmed, or to the login a signed-in User links it to themselves; an unconfirmed address cannot sign in. We keep the record of the link (the provider, the identifier it issued, the email address, the name, and when it was linked and last used) until the User unlinks it or the login is deleted; a deactivated login cannot sign in with a Google account. If your login is shown in the Service without a photo, we copy your Google profile picture once and keep it as the photo of your login (clause 3.2): we do not update it afterwards, and you can replace or delete it in your settings. An Account created with a Google account has no password until the User sets one. We do not offer other sign-in providers yet. Legal basis: performance of the contract where the Customer is a natural person, otherwise our legitimate interest in providing the access the Customer ordered (Article 6(1)(b) and (f) GDPR). Google processes your data under its own privacy policy.

4. Data of Clients That We Process Ourselves

4.1. This Section describes which data of Clients we process as an independent controller. Your other data, including visits and the client card, is processed by the business (Section 2). A link to this policy is at the bottom of every Booking Page and of the DEK account.

4.2. Online booking. In the booking form, you must provide your name and your phone number or email address (which of them depends on the channel through which the business sends messages); this data is received and controlled by the business. When you book a visit online, choose the language of messages on the visit management page, opt out of emails through the link in an email, or link or delete a DEK Identity, this action and your IP address are recorded in our security log. When you book, your IP address and email address are also checked by the protective measures described in clauses 4.12 and 4.13. Legal basis: our legitimate interest in ensuring the security of the Service and investigating incidents (Article 6(1)(f) GDPR).

4.3. DEK Identity. A DEK Identity is your personal account in the Service, in which you see your visits with the businesses whose client card is linked to your DEK Identity. You can create it on the visit management page by clicking "Create account" and entering a one-time code, which is sent to the email address stated on the business's client card or, if there is none, to the phone number. If another business's client card contains the same contact and you also confirm it there with a code, that card is linked to the same DEK Identity. A DEK Identity is optional: visits can be booked and managed without it.

4.4. DEK Identity data. We process your first name and surname (initially taken from the business's client card), one confirmed contact (an email address or a phone number) and the time it was confirmed, your language, your photo, if you upload one or if we copy it from your Google account (clause 4.16), and the links to businesses' client cards. The source of the contact is the business with which you booked a visit (the business entered or imported the contact, or you provided it when booking), and later you yourself. Purpose: to create and manage your DEK Identity, to confirm your contact and to link the DEK Identity to businesses' client cards. Legal basis: entering into and performing the contract for a free DEK Identity, which you conclude by creating it (Article 6(1)(b) GDPR). The visits you see in the DEK Identity remain the data of the business that recorded them: we show them to you on that business's behalf (Section 2). A DEK Identity cannot be created without confirming the contact with a code; the photo is optional.

4.5. One-time codes. We send the codes for creating and logging in to a DEK Identity in our own name: by email through the Service's email servers, or by SMS from the sender "DEK" through the SMS provider SIA VERTEX LV (clause 6.11) and, while no VertexSMS key is configured in the Service, through our own asms.lt account (clause 6.3). The SMS provider receives the phone number, the text of the message with the code, the sender name and the time of sending, and returns a delivery report to us (delivered, not delivered or expired, with the code of the mobile network). A code is valid for 10 minutes and can be entered no more than 5 times, and only its hash value is stored in the Service database; the text of a code sent by SMS and the phone number remain in the provider's systems under its terms: under its privacy policy, SIA VERTEX LV keeps communications data for two months by default, and in our asms.lt account and on the SMS sending device they are kept for the period stated in clause 8.6. For each code, we record the contact to which it was sent, the IP address and the time, and for each SMS message sent in our name we keep the record described in clause 8.6, without the text of the message. The code record is created, and the code is sent, also when a code is requested on the login page for a contact for which no DEK Identity exists: this way the page does not reveal whether a DEK Identity exists for that contact, but while no DEK Identity exists, such a code cannot be used to log in. Legal bases: entering into and performing the DEK Identity contract, as regards sending the code (Article 6(1)(b) GDPR), and, where the code is sent to a contact for which no DEK Identity exists, our legitimate interest in not revealing for whom a DEK Identity exists (Article 6(1)(f) GDPR), and our legitimate interest in protecting accounts against takeover and the sending of codes against abuse, and in settling with businesses for the messages sent on their instruction, as regards keeping the records (Article 6(1)(f) GDPR). On a business's instruction (clause 21.3 of the Terms), we send the same codes to verify a phone number on its Booking Page, where the business requires a mobile number verified by SMS code (a landline number cannot be used to book on such a page, and a verified number is remembered in your browser session for 24 hours), on a client card, and for the business's own number and a Team Member's number; a person authorised by the Operator (for example, when the SMS provider is not working) may verify a number by hand or, for up to 7 days, allow bookings with it without a code, and every such record states who verified it. We process these codes, the verification records and the mark on the client card that the number is verified as the business's processor under the DPA, and the business informs about them in its privacy notice (clause 11.4 of the Terms).

4.6. What businesses receive. Once your client card is linked to a DEK Identity, the email address or phone number on that card at the business is updated from your confirmed contact at the time of linking and each time you save your profile; the name is entered only if the card does not contain one (clause 17.3 of the Terms). We update the contact on the client card on that business's behalf (clause 21.3 of the Terms), and we transfer your confirmed contact to the business in performing the DEK Identity contract (Article 6(1)(b) GDPR). We do not transfer to businesses your photo, the names of other businesses or your visits with them; the only information relating to other businesses that a business can see is the combined Reliability Score referred to in clause 4.10. A business cannot itself create a link or search for DEK Identities, but a business on a paid Plan that shares numbers can infer from the fact that the combined score is shown on a client card that the card is linked to a DEK Identity; one business's notes, consents and other data are not transferred to other businesses.

4.7. Deleting the DEK Identity. You can delete your DEK Identity at any time in your DEK account. Its first name, surname, contact and photo are then deleted, the links to businesses' client cards are removed and the combined Reliability Score is no longer calculated. Businesses' client cards and visits are not deleted, because they are controlled by the businesses. One-time code records and security log entries are deleted in accordance with the periods set for them in Section 8.

4.8. Combined Reliability Score. The Reliability Score shows what share of the sum of attended visits, no-shows and late changes is made up of attended visits (clause 2.18 of the Terms). Each business calculates the score of its Clients in its own Account; this is data processed by the business. If you have a DEK Identity, we, as an independent controller, also calculate a combined Reliability Score across several businesses (clause 17.4 of the Terms).

4.9. What data is used and where it comes from. Only three numbers from each linked client card are used for the combined score: the numbers of attended visits, no-shows and late changes (your cancellations or reschedulings less than 24 hours before the visit, and cancellations that the business has marked as having occurred through the Client's fault). We obtain these numbers from the businesses at which your client card is linked to a DEK Identity and which have not switched off sharing them in the settings of the Service; sharing is switched on by default. The numbers from deleted Accounts and deleted client cards are not included. The numbers change according to the visit statuses marked by the business, your actions (for example, a cancellation through the link or a reply by SMS) and automatically: a visit that is still marked as booked or confirmed more than 2 hours after it ended is marked as attended. Visit dates, services, notes, business names and other data are not used for this purpose. The score is calculated each time it is shown and is not stored separately.

4.10. Who sees the combined score. You see it in your DEK account as a percentage together with the numbers of attended visits and of all visits taken into account. A business on a paid Plan that itself shares numbers sees only a single aggregated percentage on your client card; business names and the numbers of each business are not shown separately. Because the combined score also includes the numbers of the business viewing it, a business that compares it with its own score can roughly estimate your attendance at the other businesses taken together. A business that has switched off sharing does not see the combined score.

4.11. Legal basis and right to object. We process the combined score on the basis of our legitimate interest (Article 6(1)(f) GDPR): participating businesses can plan their time better and reduce the number of booked visits that do not take place, and you see your reliability across all linked businesses. The combined score is profiling (Article 4(4) GDPR), because it evaluates how reliably you attend booked visits. We consider that your interests, rights and freedoms do not override this interest, because the score is calculated only for persons who have created a DEK Identity, only three numbers are used, businesses are shown only a single percentage without business names, a business may choose not to share numbers, the score does not itself reject or change bookings, and a business may not refuse to serve you solely on the basis of the score (clause 17.2 of the Terms). Because sharing is switched on by default at businesses and you cannot switch it off yourself, we inform you clearly about this processing in this policy. You may object to the calculation of the combined score at any time by writing to pagalba@majevski.com. If we have no compelling legitimate grounds to continue the processing, we stop it by removing the links between your DEK Identity and the businesses' client cards. The Service has no setting that switches off only the combined score, so after that you will no longer see those businesses' visits in your DEK account, and if you link the cards again, the combined score will be calculated again. Once the DEK Identity is deleted, the combined score immediately ceases to be calculated.

4.12. Protection against abuse. To protect the Service, its users and the shared message sending infrastructure against password guessing, fake Accounts, fake bookings and spam, we process IP addresses, hash values of email addresses (SHA-256) and email domains, the number of requests from the same IP address or contact within a given period, the results of form checks against bots and information about suspicious activity (the category, for example password guessing, a fake account or spam, and the place where the activity was detected). These measures apply to everyone, not only to Clients: when logging in, creating an Account, requesting a password reset or a one-time code, booking a visit, using visit links and email unsubscribe links, and signing up for the waiting list.

4.13. M Blacklist. M Blacklist (black.majevski.com) is a threat database that we operate ourselves. When the permitted number of requests is exceeded, a login is blocked after failed attempts or form protection is triggered, the IP address and, in the case of form protection, also the hash value of the email address may be transferred to M Blacklist, together with the category, the place where the activity was detected and the result of the form protection check. The Service receives from M Blacklist the list of confirmed threats (IP addresses and their ranges, hash values of email addresses and email domains) and compares the IP address, the hash value of the email address and the email domain being checked against it; until a copy of the list has been prepared in the Service, this data is sent to M Blacklist for checking. Reports to M Blacklist are made by websites registered and approved by its administrator, and an entry is added to the list of confirmed threats only when it is confirmed by several independent websites or by a website that the M Blacklist administrator has marked as trusted. M Blacklist publishes the list of confirmed threats (without names or email addresses) through a public application programming interface and a list copying function, which can be used without an account by any website or other person wishing to protect its services against abuse, including other services related to the Operator (clause 21.6 of the Terms); we provide information about those services on request made by email to pagalba@majevski.com.

4.14. Source of protective data and legal basis. We obtain protective data from the requests of your device and from M Blacklist, to which other websites also send reports. Legal basis: our legitimate interest in ensuring the security of the Service, its users and the shared sending infrastructure and in preventing abuse (Article 6(1)(f) and Recital 49 GDPR). We consider that your interests, rights and freedoms do not override this interest, because the publicly available list contains no names or email addresses, an entry is published only after it has been confirmed by several independent websites or by a website marked as trusted and is removed 90 days after the last confirmation, and we remove data included without good reason once we receive your request (clause 9.3). From the Service, M Blacklist receives IP addresses, hash values of email addresses and brief information about the event (the category, the place where it was detected and the result of the form protection check) and, until a copy of the list has been prepared in the Service, also the email domains being checked; the list of confirmed threats contains only IP addresses and their ranges, hash values and domains, so we cannot individually inform the persons reported by other websites; we make this information public in this policy (Article 14(5)(b) GDPR). Automated decisions and their review are described in Section 9.

4.15. The dictionary of first names. Lithuanian and Polish write a name in a different form when a message speaks to you ("Vitoldai" rather than "Vitoldas"), so that a business's message can be written correctly, we keep a dictionary of first names common to the whole Service. When a first name entered in the Service is not yet in it, the name is added as a word: the entry holds the forms of that name in each language and its nameday, and nothing that links it to you, to the business or to your other data, so an entry says nothing about who carries the name. The nameday is taken from a calendar service, to which we send only a date and a language; to prepare the forms of the name we use an artificial intelligence service, to which only the name itself is sent, as a single word. A person checks every entry before it is used. Your name in the business's client card is not changed by this; the card only notes which entry of the dictionary it matched. Legal basis: our legitimate interest in the messages sent through the Service being written in correct language (Article 6(1)(f) of the GDPR).

4.16. Signing in with a Google account. When booking a visit on a Booking Page and when logging in to a DEK Identity you can choose to sign in with a Google account. We then receive from Google your Google account identifier, your first name and surname, your email address, the link to your Google profile picture and Google's confirmation that the email address is yours, and Google learns that you sign in to the Service. An email address confirmed by Google counts as confirmed in the same way as a contact confirmed by a code (clauses 4.3 and 4.5): on a Booking Page it is written into the booking and remembered in your browser session for 24 hours, the business's client card is marked as having a confirmed address, your DEK Identity is created or found, the client card is linked to it and you are logged in to your visits, and on the login page you log in with it without a code. In that case we do not keep the Google account identifier. If your DEK Identity has no photo, we copy your Google profile picture once as its photo (clause 4.4): we do not update it afterwards, we do not pass it to businesses, and you can replace or delete it in your DEK account. We process the mark on the client card that the address is confirmed as the business's processor under the DPA, and the DEK Identity as a controller (clause 4.4). Legal basis: conclusion and performance of the DEK Identity contract (Article 6(1)(b) GDPR). Google processes your data under its own privacy policy.

5. Visitors to the Website and Booking Pages

5.1. Necessary cookies. On the website and on Booking Pages, we use necessary cookies: a session cookie (dek_s), a cookie storing your cookie choice (dek_consent), a language cookie (dek_lang), a form protection cookie (dek_pub) and, if you tick "remember me" when logging in, a cookie remembering your login (dek_r). They require no consent, because they are necessary to provide the service you request (Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania). Legal basis: our legitimate interest in ensuring the operation and security of the website (Article 6(1)(f) GDPR). The full list and the expiry periods are set out in the Cookie Policy.

5.2. Consent log. When you choose which cookies you allow, we record a random device identifier, your choice and its time, the version of the Cookie Policy, the language, a truncated IP address and browser data. Legal basis: the legal obligation to demonstrate that consent has been obtained (Article 6(1)(c) and Article 7(1) GDPR).

5.3. Analytics. If you consent to analytics cookies, we use Google Analytics and our own analytics system nda.lt to understand how visitors use the website and Booking Pages and to be able to improve the Service; the pages on which these tools run, and the conditions under which they run, are set out in clause 5.4. These tools process a random visitor identifier stored in cookies (Google Analytics: _ga and _ga_ with the property identifier) or in browser storage (nda.lt: visitor_uuid), the pages visited and their titles, where you came from, the time of the visit, clicks, scrolling and the fact that a form was submitted (depending on the tool; without the data entered in the form), screen size, device type, browser, time zone and the IP address that the analytics server receives when the connection is established. nda.lt also receives the full page address including query parameters, and on the website (not on Booking Pages) it also receives the position of the click and the text of the clicked element up to 61 characters (for example, the label of a button or link) and may receive the addresses and labels of clicked links. Legal basis: your consent (Article 6(1)(a) GDPR; Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania). If you do not consent, analytics is not activated, and the website and Booking Pages work in the same way.

5.4. Where analytics runs and what it does not receive. Analytics may run on the website and on Booking Pages, except the Booking Pages of businesses whose Owner has not personally accepted version 2.1 or a later version of the Terms when creating the Account or in the Service; a notice of a new version of the Terms alone is not enough for this. This condition does not apply to the Booking Page of the demo account (clause 5.9). It never runs on pages whose address contains a personal link or an access token, for example the visit management, email unsubscribe, DEK account and password reset pages, and these pages do not pass their address on to the next page that is opened. Analytics is also not used in the Service's work environment for logged-in Users. The addresses of the page and of the referring page are transmitted to Google Analytics without query parameters, and on Booking Pages the Google signals function and ad personalisation are switched off. If you consent to marketing cookies as well, then on the website (not on Booking Pages) Google Analytics data may also be used for Google advertising features, and Google may store additional cookies. On Booking Pages, apart from Google Analytics, only an analytics tool that we have marked as allowed for use there may run, and we give that mark only to a tool configured not to record click positions, the text of clicked elements or clicked links (their addresses and labels), not to make session recordings and not to create heatmaps. If nda.lt runs on a Booking Page, it may receive there the data referred to in clause 5.3, including the full page address with its query parameters (which contains no personal links or access tokens), but it does not receive click positions, the text of clicked elements or the addresses and labels of clicked links. Analytics tools do not receive the data you enter or select in the booking form. On Booking Pages, we process analytics data as an independent controller, not on the business's behalf (clause 21.6 of the Terms).

5.5. Meta Pixel. If you consent to marketing cookies, we use Meta Pixel on the website to measure the effectiveness of our advertising and to be able to show advertising on Meta platforms. Meta Pixel processes identifiers stored in cookies (_fbp and, if you came through a link clicked on a Meta platform, _fbc), the addresses of the pages visited and of the page you came from, actions on the website, browser and device data and the IP address. If you came to the website by clicking a link on a business's Booking Page, Meta may also receive the address of that page, from which the business can be identified. Legal basis: your consent (Article 6(1)(a) GDPR; Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania). Meta Pixel and other advertising tools (for example, Google Ads) do not run on Booking Pages; if a business requested in writing that they be installed on its Booking Page (clause 21.6 of the Terms), we would update this policy beforehand. We and Meta Platforms Ireland Limited are joint controllers in respect of the collection of data on the website and its transmission to Meta Platforms Ireland Limited (Article 26 GDPR). We are responsible for ensuring that the data is collected only with your consent and that you receive this information; as regards the data that Meta Platforms Ireland Limited stores after receiving it, you may also exercise your rights directly against it. Meta Platforms Ireland Limited processes the data it receives as an independent controller under its own privacy policy. As regards the joint processing, you may exercise your rights both against us and against Meta Platforms Ireland Limited.

5.6. Withdrawing consent. The analytics and marketing tools currently in use are listed in the Cookie Policy. There you can also change or withdraw your consent at any time; from a Booking Page, you can reach the Cookie Policy through the Privacy Policy link at the bottom of the page. Your choice is stored in the dek_consent cookie and applies to the whole website https://dek.lt, including the Booking Pages of all businesses, in that browser for 180 days, unless you change it earlier or the version of the Cookie Policy changes; we then ask you to choose again. Once you withdraw consent, analytics and marketing tools are no longer loaded in that browser. Withdrawal does not affect the lawfulness of processing carried out before it.

5.7. Server logs. The Service's server logs errors, security events, warnings and certain other technical events (for example, when an email fails to be sent or when sending to a non-existent address is switched off), recording the request address (which may also contain a personal link), the request method, the IP address and the circumstances of the event, for example the identifier of an Account or client record or the recipient's email address when an email cannot be sent. The hosting provider may process server access logs under its own rules and for the periods set in them. Legal basis: our legitimate interest in ensuring the operation and security of the Service and in detecting and correcting errors (Article 6(1)(f) GDPR).

5.8. Enquiries. When you write to us about support, a complaint, a notice of unlawful content (Section 20 of the Terms), your rights or any other matter, we process your name, contact details, the content of your enquiry and our replies. Legal bases: a legal obligation where the enquiry concerns your rights under the GDPR or a notice under Regulation (EU) 2022/2065 (Article 6(1)(c) GDPR); performance of a contract where the enquiry is made by a Customer who is a natural person (Article 6(1)(b) GDPR); in other cases, our legitimate interest in responding to the enquiry and in defending legal claims (Article 6(1)(f) GDPR).

5.9. Demo account. Visits and clients entered by visitors in the demo account are deleted every night, and until then they are visible to other visitors, so entering real personal data in it is prohibited (clause 6.7 of the Terms). If you nevertheless create a DEK Identity on a demo visit management page, the code is sent to the real contact provided and a real DEK Identity is created, which is not deleted overnight; you can delete it in your DEK account. Legal basis: our legitimate interest in enabling people to get to know the Service (Article 6(1)(f) GDPR); a DEK Identity created on a demo page is subject to the legal basis referred to in clause 4.4.

6. Recipients of Data

6.1. We do not sell personal data. We disclose data only to the recipients listed in this Section and only to the extent necessary for the purposes set out in this policy. Processors process data on our behalf under the data processing terms agreed with them. Of the data we control, Customers (businesses) receive the confirmed contact of a linked Client (clause 4.6), the combined Reliability Score (clause 4.10) and notices of the Operator's logins to their Account (clause 3.8). The M Blacklist list of confirmed threats is made publicly available (clause 6.7).

6.2. UAB "Interneto vizija" (legal entity code 126350731, J. Kubiliaus g. 6, 08234 Vilnius, Lithuania), processor: hosting services for the servers, database, files and backups of the Service and of M Blacklist; email server services for the Service (sending emails, receiving bounced emails and replies); and services for the mailbox that receives enquiries sent to pagalba@majevski.com. The servers are located in Lithuania (European Union).

6.3. Hostinger International Limited (61 Lordou Vironos str., 6023 Larnaca, Cyprus), processor: hosting services for our systems asms.lt (through which SMS codes are sent where no VertexSMS key is configured in the Service; businesses' "Premium SMS" messages are not sent through it), 1e.lt and nda.lt on servers in the European Union. nda.lt processes the analytics data referred to in clause 5.3, and businesses' campaigns, the data of which we process under the DPA, are sent through 1e.lt.

6.4. Stripe Payments Europe, Limited (The One Building, 1 Grand Canal Street Lower, Dublin D02 H210, Ireland), payment service provider. Stripe processes Customers' payments for the Service as our processor and, for its own purposes, for example to prevent fraud and money laundering and to comply with other legal obligations, as an independent controller under its own privacy policy. Stripe does not receive Client Data.

6.5. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), provider of the Google Analytics service and processor under the Google Ads Data Processing Terms, receives the analytics data referred to in clause 5.3.

6.6. Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland) receives the Meta Pixel data referred to in clause 5.5 as a joint controller in respect of its collection and transmission, and then processes it as an independent controller.

6.7. M Blacklist and our other services. We operate M Blacklist, asms.lt, 1e.lt and nda.lt ourselves, so they are not separate recipients of data; their hosting providers are listed in clauses 6.2 and 6.3. The recipients of the M Blacklist list of confirmed threats are all those who use the publicly available M Blacklist application programming interface or a copy of the list to protect their services, including other services related to the Operator (clause 4.13).

6.8. Communications and email service providers. An SMS message is delivered to you by the mobile network operator, and emails by your email service provider (for example, Gmail or Outlook). They act as providers of electronic communications or email services under their own terms, not as our processors.

6.9. Services chosen by the Customer or by you. When a Team Member subscribes to a Calendar Link in Google, Apple, Microsoft or another calendar service, the provider of that service receives visit data on the Customer's instruction, including Clients' names, phone numbers and notes (clauses 18.1 and 18.2 of the Terms). When you click the link on the visit management page to add the visit to Google Calendar, Google receives the time of the visit, the services, the business name and the address or meeting link. These providers are not our processors.

6.10. Authorities, advisers and successor. We provide data to courts, law enforcement and other public authorities where required by law or by a lawful order of an authority (clause 20.7 of the Terms). To the extent necessary, we may disclose data to providers of accounting, legal and other professional services and to the banks through which payments are received. If the Service business or part of it is transferred, data is transferred to the acquirer or legal successor (clause 33.2 of the Terms).

6.11. SIA VERTEX LV (registration No. 50003866501, Mihoelsa iela 66-10, Daugavpils, LV-5401, Latvia; data protection contact dp-lv@vertexsms.com), provider of the VertexSMS service and processor: sending SMS messages from the sender "DEK", namely one-time DEK Identity codes (clause 4.5), codes sent on businesses' instruction to verify phone numbers on Booking Pages and client cards and, where a business on the VIP Plan switches on the "Premium SMS" function in the Service (clause 14.10 of the Terms), that business's SMS messages: automatic messages to Clients related to visits, messages typed by Users and test messages. The business is the controller of "Premium SMS" messages; we send them as its processor under the DPA, and SIA VERTEX LV acts as a Sub-processor engaged by us. The provider receives the phone number, the text of the message with the code or of the business's "Premium SMS" message, the sender and the time of sending, and returns to us a delivery report with the code of the mobile network. The provider is established in Latvia (European Union); the electronic communications partners it uses to deliver a message may process the number and the text of the message also outside the European Economic Area (clause 7.7).

7. Transfers of Data Outside the European Economic Area

7.1. The Service database, files and their backups are stored on servers in the European Union (clause 7.7 of the Terms). Data may be transferred outside the European Economic Area (EEA) in the cases set out in this Section. In the list of sub-processors in its data processing agreement, UAB "Interneto vizija" also names companies established outside the EEA (in the United States of America, the United Kingdom, Canada, Singapore and Pakistan), but does not state which of them may obtain access to the data on our server. On request, we provide this list and the information known to us about the safeguards applied (clause 7.6). Should companies engaged by this processor or by our other processors obtain access to data from outside the EEA, this is permitted only subject to the safeguards provided for in Chapter V of the GDPR.

7.2. Stripe. Stripe transfers data to Stripe, LLC (United States of America) and may transfer it to other companies in its group or to service providers in other countries, for example India. Stripe, LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Commission Implementing Decision (EU) 2023/1795); in addition, Stripe's data processing agreement and data transfers addendum provide for the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.

7.3. Google. Google Ireland Limited may transfer Google Analytics data to Google LLC (United States of America) and to other companies of the Google group. Google states that for such transfers it relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and, where that framework would not apply, on the standard contractual clauses provided for in the Google Ads Data Processing Terms (Commission Implementing Decision (EU) 2021/914).

7.4. Meta. Meta Platforms Ireland Limited may transfer the data it receives to Meta Platforms, Inc. (United States of America), which is certified under the EU-US Data Privacy Framework. Meta carries out the onward transfer as an independent controller under its own privacy policy.

7.5. Calendars. Providers of calendar services that receive Calendar Link data on the Customer's instruction, and Google, when you yourself add a visit to Google Calendar, may process the data outside the EEA under their own terms (clause 18.2 of the Terms).

7.6. Copies of safeguards. We provide a copy of the standard contractual clauses and other applicable safeguards, or information on where to find them, on request made by email to pagalba@majevski.com. Stripe, Google and Meta also publish these documents on their websites.

7.7. SMS provider. SIA VERTEX LV is established in Latvia, but uses electronic communications partners to deliver an SMS message, and these may also be outside the EEA, so the phone number and the text of the message with the code or of a business's "Premium SMS" message (clause 6.11) may be processed outside the EEA; the provider does not name specific countries. In its privacy policy (https://vertexsms.com/en/privacy), the provider states that it transfers data outside the EEA only with appropriate cross-border transfer mechanisms in place and with data protection obligations agreed with its partners by contract. On request, we provide the information published by the provider and known to us about these safeguards (clause 7.6).

8. Retention Periods

8.1. We keep data for no longer than is necessary for the purposes for which it is processed. The periods below are counted from the creation of the record, unless stated otherwise. When a period ends, the data is deleted or anonymised.

8.2. Agreement and accounts. Data of the accounts of the Customer, the Owner and Users, data on the Plan, the subscription and the administration of the Agreement (including internal notes about the Customer) and the Customer's usage metrics of the Service are kept for as long as the Agreement is in force. When the Customer removes a Team Member, the User login linked to that Team Member is deactivated, but the related data is kept until the end of the Agreement; the login of a User with the Reception role is deleted immediately (clause 30.9 of the Terms). After the Agreement ends, Section 30 of the Terms applies: after the 30-day data retrieval period, the data is deleted from active systems within 60 days at the latest. Aggregated anonymised statistics may continue to be kept.

8.3. Evidence and accounting. Records of acceptance of the Terms and the DPA (including the IP address and browser data) are kept for up to 10 years after the end of the Agreement (the general limitation period is 10 years; clause 30.8 of the Terms). Invoices issued by us are kept for 10 years (point 3.15 of the Index of Retention Periods for Internal Administration Documents). Stripe notifications about payments are kept in the Service for 3 months; payer records in our Stripe account (the Owner's email address and the business name) and payment and invoice records are kept for the same period as invoices, and Stripe keeps the data it processes for its own purposes under its own rules. Records of the Operator's logins to Accounts and notices about them are kept for 13 months.

8.4. Security and technical data. Security log entries (with IP addresses and, in some entries, for example those about logins, password resets and refused Account creation, also email addresses) are kept for 90 days, server log files for 30 days and session data for no longer than 2 days after the last activity in the session. Password reset requests are deleted 7 days after the link expires (the link is valid for 60 minutes), "remember me" tokens after 30 days, rate-limiting records 1 day after the end of the rate-limiting window, and records of failed background jobs 90 days after the failure.

8.5. Notifications. Notification sending records (recipient and status, without the content of the email) are kept for 12 months, email delivery events (bounced emails and clicks on the Service's links) for 90 days, and the delivery log with masked addresses for 14 days. Bounce notifications and replies to calendar invitations are received in a dedicated folder of the Service's mailbox. A job that the Service runs every hour automatically deletes from this folder the emails that were received more than 90 days ago; we do not guarantee the exact moment of deletion. The hosting provider of the email servers keeps the copies it makes and its logs under its own rules.

8.6. DEK Identity and protection. DEK Identity data is kept until you delete the DEK Identity; it is not deleted together with a business's data (clause 30.9 of the Terms). One-time code records are kept for 90 days. Records of SMS messages sent in our name (clause 4.5) and of "Premium SMS" messages sent on businesses' instruction from the sender "DEK" (clause 6.11), stating the recipient's number, the purpose, the provider, the number of message parts, the status from the delivery report, the provider's price, the time and, for codes, the price charged to the business and the IP address of the sending request, but not the text of the message, and phone number verification records (the number, the time, the method, the IP address and browser data and, where the number was verified by hand, who verified it) are kept for 12 months. SIA VERTEX LV keeps the texts of codes and of "Premium SMS" messages sent by SMS and the phone numbers under its own terms (two months by default under its privacy policy), and in our asms.lt account and on the SMS sending device the texts of codes and the numbers are deleted after 90 days at the latest. The text of a "Premium SMS" message also remains in the business's SMS conversation in the Account, where the business controls it (clause 2.2). Records of reports sent to M Blacklist are kept in the Service for 90 days from the sending of the report, and the record of a report that has not been sent is kept for 90 days from its creation. M Blacklist entries are kept for 90 days from the last report confirming them; the copy of them in the Service is updated periodically, and entries that are no longer valid are removed from it when an update completes and during the Service's daily task. Until a copy of the list has been prepared in the Service, the result of a check (including a result that no threat was found), together with the IP address, hash value of the email address or domain checked, is used for 10 minutes and is deleted during the first daily task of the Service run after those 10 minutes or earlier, when the copy is prepared for the first time.

8.7. Visitors. Records in the cookie consent log are kept for the period of validity of the consent (180 days) and for a further 1 year. Google Analytics event-level and user-level data associated with the visitor identifier are kept for no longer than 14 months from the last visit, and nda.lt analytics data for no longer than 14 months from its collection; aggregated reports from which a person cannot be identified may be kept for longer. Meta Platforms Ireland Limited keeps Meta Pixel data under its own rules. The expiry periods of cookies are set out in the Cookie Policy. Waiting list entries are kept for 12 months. Visits and clients entered in the demo account are deleted the following night.

8.8. Enquiries. Correspondence and documents relating to the handling of enquiries are kept while the enquiry is being handled and, after that, only for as long as is necessary to prove the reply and to defend possible legal claims relating to it.

8.9. Backups. In the backups made by the hosting provider, data remains until the backups are overwritten in the ordinary course at the frequency set by the provider (clause 24.3 of the Terms). To investigate an error, for maintenance or to provide the data referred to in clause 30.4 of the Terms, persons authorised by the Operator may make a copy of the Service database or part of it on a device of the Operator; such a copy is used only for that purpose and is deleted when it is no longer needed, but no later than 14 days after it was made. After the Agreement ends, clause 30.7 of the Terms applies to Account data, including Client Data: it remains in backups for no longer than 90 days after deletion from active systems.

8.10. Longer retention. We keep data for longer only to the extent required by law or necessary to bring or defend legal claims, for example until a dispute or proceedings relating to a breach have ended (clause 30.8 of the Terms).

9. Automated Decisions

9.1. What is checked and what is decided. The anti-abuse measures take decisions automatically, without human intervention. If your IP address is marked in M Blacklist as a confirmed threat and its rating reaches the threshold we have set, the Service rejects the login, the creation of an Account, the sending of a password reset email, the sending of a one-time code, a booking on the Booking Page or a sign-up for the waiting list. If the hash value of the email address you entered or your email domain is so marked and its rating reaches that threshold, the Service rejects the creation of an Account, a booking, a sign-up for the waiting list or the sending of a one-time code by email on the DEK account login page. If the IP address is marked but its rating does not reach the threshold, fewer attempts are allowed for a User's login. If request limits are exceeded (for example, after 5 failed login attempts within 15 minutes), the action is temporarily blocked.

9.2. Consequences. As a result of a rejection, you may be unable to book a visit online, log in, create an Account or receive a code. So that abusers cannot circumvent the protection, a rejection may be shown as a generic message (for example, "Too many attempts"), as an ordinary confirmation even though no code or email is sent, or, when creating an Account, as a redirection to the login page without explanation. Several persons may use the same IP address (for example, on a mobile network), so the measure may also be triggered in error. Your client card, visits and Reliability Score are not changed as a result of a rejection. These decisions are taken only for the purpose of protection against abuse and apply for a limited time, and a Client may contact the business directly about a visit. We therefore consider that they do not usually produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22(1) GDPR, but in any event we provide the safeguards referred to in clause 9.3.

9.3. Human review. You have the right to require that a decision be reviewed by a human, to express your point of view and to contest the decision. Write to pagalba@majevski.com, stating what action you tried to perform and when. A responsible person of the Operator examines the request without undue delay and in any event within one month (clause 11.3; clause 17.7 of the Terms), and we remove data included without good reason from M Blacklist.

9.4. What is not an automated decision. The Reliability Score does not itself reject or change bookings and does not take any other decisions about you. Other automatic actions of the Service, for example changing the status of a visit on the basis of a Client's SMS reply or marking a visit as attended after it has ended, are carried out on behalf of businesses under the Terms and the DPA. Also on behalf of businesses, in order to protect the shared sending infrastructure: where the recipient's mail server refuses an email during sending because the address does not exist, the sending of emails to that address is switched off on that business's client card, and where a report that the address does not exist is received in the Service's mailbox, it is switched off on the client cards of all businesses that contain that address, regardless of whose email was rejected (clause 15.3 of the Terms).

10. Security

10.1. We apply, among others, the following technical and organisational measures: data is transmitted over an encrypted HTTPS connection; passwords are stored only as hash values; one-time codes, password reset links and "remember me" tokens are stored as hash values and are valid for a limited time; Customers' asms.lt API keys are stored in encrypted form; the Account functions available to Users depend on the role assigned by the Customer; rate limiting and protection against abuse are applied; important actions are recorded in the security log; every login by the Operator to an Account with the rights of a User is recorded; payment card details are entered only on Stripe's pages.

10.2. Persons authorised by the Operator who have access to personal data are required to keep it confidential.

10.3. No system can ensure complete security, so we do not guarantee that no security breaches will occur. If a personal data breach involving data that we control ourselves occurs, we will, in the cases laid down by law, notify the State Data Protection Inspectorate of it without undue delay and, where the breach is likely to result in a high risk to your rights and freedoms, also notify you. We notify businesses of breaches involving Client Data under the DPA.

10.4. You also contribute to security: do not share login credentials, visit links or Calendar Links, and report any suspected unauthorised access immediately to pagalba@majevski.com.

11. Your Rights

11.1. In respect of the data we control ourselves, you have the right: 1) to access your data and obtain a copy of it (Article 15 GDPR); 2) to request rectification of inaccurate data (Article 16 GDPR); 3) to request erasure of data (Article 17 GDPR); 4) to request restriction of its processing (Article 18 GDPR); 5) to receive the data you have provided in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means (Article 20 GDPR); 6) to withdraw consent at any time; 7) to object to processing (Article 21 GDPR); 8) to request that a protective decision taken automatically be reviewed by a human, to express your point of view and to contest the decision (Section 9). These rights are not absolute: for example, we cannot erase data that we are required to keep by law or that is needed to defend legal claims.

11.2. Right to object. Where we process data on the basis of our legitimate interest (for example, for the combined Reliability Score, protection against abuse, logs or statistics), you may object to such processing at any time on grounds relating to your particular situation. We then stop the processing, unless we demonstrate that we have compelling legitimate grounds which override your interests, rights and freedoms, or the data is needed for the establishment, exercise or defence of legal claims. On request made by email to pagalba@majevski.com, you will receive an explanation of why we consider that our legitimate interests are not overridden by your interests, rights and freedoms.

11.3. How to exercise your rights. Write to pagalba@majevski.com. To avoid disclosing data to another person, we may ask you to confirm your identity, for example by writing from the email address stated in the Service or by providing additional information. We respond without undue delay and in any event within one month of receiving the request. Taking into account the complexity and number of requests, we may extend this period by two further months, informing you of this and of the reasons within the first month (Article 12(3) GDPR). We act on requests to exercise your rights free of charge, except in the cases referred to in Article 12(5) GDPR.

11.4. What you can do yourself. In their DEK account, a Client can view the visits at linked businesses and their own combined Reliability Score, change their first name, surname and photo, and delete the DEK Identity; the email address or phone number can be changed only by writing to pagalba@majevski.com. Emails can be opted out of through the link in the email, and the language of messages can be chosen on the visit management page. A User can change their name, language and password in the Service; other User data and access are managed by the Customer. Cookie consent can be changed on the Cookie Policy page.

11.5. Data controlled by a business. For data that a business processes about you as a controller (the client card, visits, notes, SMS messages, consents to receive messages), contact the business. As a processor, we help the business to give effect to your rights under the DPA, and we forward a request made to us to the business without undue delay (clause 2.2).

11.6. Complaints. If you believe that your data is processed in breach of the law, we invite you to contact us first. You also have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, vdai.lrv.lt) or with the supervisory authority of the EU Member State in which you live or work or in which the alleged infringement took place. If the complaint concerns the rights referred to in Articles 15 to 22 GDPR, the State Data Protection Inspectorate asks you to state how you first contacted us, and does not examine a complaint lodged before the one-month period for a reply has expired (Articles 24 and 27 of the Law on Legal Protection of Personal Data of the Republic of Lithuania).

12. Children

12.1. The Service is intended for businesses. A DEK Identity is not intended for persons under the age of 14; we do not verify age.

12.2. If a DEK Identity was created by a person under the age of 14 without the consent of their parents or other legal representatives, their parents or other legal representatives may request its deletion by email to pagalba@majevski.com. We delete such a DEK Identity upon receiving the request or upon becoming aware of it ourselves.

12.3. A business that enters data of Clients who are minors (for example, when booking a visit for a child) processes that data as a controller and is responsible for compliance with the requirements applicable to such data (clause 12.6 of the Terms).

13. Changes to the Policy

13.1. We update this policy when the functions of the Service, the processing of data or the law change. Changes to the policy are not amendments to the Agreement (clause 21.2 of the Terms).

13.2. We give notice of material changes, for example new purposes of processing, new categories of recipients or a new transfer outside the EEA, at least 14 days in advance on the website and, to Customers, also by email or by a notice in the Service, except where a change is needed immediately due to legal requirements or for security reasons. If new processing requires consent, we will ask for it.

13.3. The current version, with its version number and date of update, is published at https://dek.lt/privacy. Earlier versions remain available on the website and are provided on request made by email to pagalba@majevski.com.

13.4. The policy was drafted in Lithuanian and is published in Lithuanian, English, Polish and Russian. If the language versions differ, the Lithuanian text prevails.