Privacy policy

1. Data controller

Irta Vaičekauskienė, the owner and administrator of the property, trading under a Lithuanian business certificate (verslo liudijimas) for short-term apartment rental (certificate number pending issue). Address: Teatro g. 5-3, 91247 Klaipėda, Lithuania. Email: info@teatro.lt. Tel.: +370 658 00998.

2. What data we collect

Contact form: your name, email address and message. This is sent directly to info@teatro.lt and is not stored elsewhere. So that the same message is not sent twice, and the automatic reply reaches one address no more than once a week, only a cryptographic hash of them is kept on the server, for up to 7 days.

Direct bookings: name, email, phone and booking details are stored in our database (EU). Card payments are processed by Stripe, Inc. — card data never touches our server; cryptocurrency payments are processed by CoinGate, and bank-link payments by Paysera.

Payment data — card number, expiry date, CVC, billing details, IP address and amount — is processed directly by Stripe, Inc. It is entered into Stripe’s own form embedded in our page and does not reach our server. We store only the payment status and the Stripe transaction reference — no card digits at all, not even the last four. If you pay in cryptocurrency, the payment is processed by CoinGate (Lithuania): they receive the currency, your wallet address, the amount and, where the law requires it, your identity details directly on their payment page. We store only the CoinGate order number and its status. If you pay by bank link, the payment is processed by Paysera LT, UAB (Lithuania): you choose your bank on their payment page and pay from your own account, so they receive the bank, the amount, your name and your account directly, on their page and from your bank. We send them only the booking reference, the amount and the page language, and we store the Paysera order number, the payment status and their reports of the payment, without the payer’s name and email.

Booking statistics: the steps of a booking (opened, checked dates, started or failed to pay, paid) and button presses, with the page address, time, referring website’s domain and link tag (such as utm_source) of that step, and your answer to the cookie banner. Visits and page views are counted only by our developer’s visit counter (count.sudievu.lt, see below). The booking statistics are collected for every visitor except those who press “Decline” on the cookie banner, on our own server, without cookies and without storing anything in your browser (apart from the opt-out cookie, see section 5). Your IP address and browser name are not kept in them: they are only used to compute a cryptographic hash (HMAC-SHA256 with a random “salt”) that includes the date, so it changes every day and every month, and the IP address cannot be recovered from it. To protect the site from abuse, a hash of the IP address is kept on the server for up to an hour to limit the number of requests. Google Analytics is loaded only if you press “Accept”.

Visit counter (count.sudievu.lt): our pages also load a small script that reports to count.sudievu.lt, a visit counter run by the website’s developer (sudievu.lt) on a server in Lithuania. It counts the address of the page viewed (without anything after “?”), the time, the name of the website you came from (only its name; if your browser does not send it and the link’s utm_source tag is a website’s name, such as chatgpt.com, that name), whether the page was looked at for at least 8 seconds and, if you arrived through an advertising link, its three tags (utm_campaign, utm_source and utm_medium: for which campaign, where the link was published, and through what kind of channel). Visits are grouped by a code computed from a random “salt” that is new every day, the website, your IP address and your browser name; the salt is deleted the next day, so the code cannot be linked to you or to any other day. Neither your IP address nor your browser name is stored, and no cookies are used. The counter does not depend on your answer to the cookie banner; section 5 says how to opt out of it. To the booking page the counter answers with the tags of the advertising link you first arrived through that day, if there was one; when you book, the page sends those tags with the booking, and only they are kept with it (they are deleted after 14 months). From the bookings we make totals per campaign and day: the number of bookings and of paid bookings, the nights and the amount paid (a cancelled booking leaves the paid ones). The totals hold no names, e-mail addresses, booking references or times of day; they show which advertising works.

3. Legal basis for processing

• Fulfilling your booking and corresponding about it — performance of a contract (GDPR Art. 6(1)(b)).
• Keeping accounting records — legal obligation (GDPR Art. 6(1)(c)).
• Replying to a contact-form enquiry — our legitimate interest in answering you (GDPR Art. 6(1)(f)), or pre-contractual steps where the enquiry concerns a booking (Art. 6(1)(b)).
• Our own cookieless booking statistics — our legitimate interest in knowing how booking on the site works (GDPR Art. 6(1)(f)). To be left out of them, press “Decline” on the cookie banner (or open the site with ?notrack=1).
• The count.sudievu.lt visit counter — our legitimate interest in knowing how many visit the site and where they come from (GDPR Art. 6(1)(f)).
• Google Analytics and its cookies — your consent (GDPR Art. 6(1)(a)). If you decline, Google Analytics is not loaded.
• Publishing your review — your consent (GDPR Art. 6(1)(a)).

4. How long we keep it

• Paid bookings — 10 years from the booking. After that the name, email address, phone number and your notes are automatically stripped from the record; only the financial data (dates, amount, payment reference) needed for accounting remains.
• Abandoned, unpaid bookings — 24 months. No contract was concluded, so the contact details are removed far sooner.
• Booking statistics — 14 months, after which the records are deleted.
• Reviews — published until you ask us to remove them. Email info@teatro.lt and we will.
• Contact-form messages — kept in the info@teatro.lt mailbox and deleted once the enquiry is resolved and no longer needed.
• Mail to info@teatro.lt — the auto-reply log (the sender’s address, the subject and whether a reply went out) is deleted after 180 days. Drafts of our own letters (recipients and text) are deleted 30 days after they are sent or discarded.
• Cryptocurrency payments (CoinGate) — an unpaid order holding your booking details is deleted after 30 days. Once the payment arrives, the details are kept only on the booking record.
• Bank-link payments (Paysera) — Paysera’s reports of a payment (stored without the payer’s name and email) are deleted after 90 days. An unpaid order is deleted after 30 days; one paid only in part, or that never became a booking, loses its copy of the booking details after 90 days.
• A payment notice we failed to record (with the guest’s name and email) is kept so that the booking can be recorded by hand, and is deleted after 90 days.
• Backups — the whole database is copied every day, and the copies are kept for no more than 30 days. Data that has been erased or anonymised therefore remains in them until they are replaced within that time.

5. Cookies

• Functional cookies — save your language preference and consent status. Necessary for the site to work.
• Google Analytics cookies — only with your consent. Our own booking statistics use no cookies.
• ta_noanalytics — set only when you press “Decline” or open the site with ?notrack=1; it is the record of your opt-out from the statistics. Lasts 2 years (Chrome: up to 400 days).
• A “do not count me” cookie — set only if you ask for it (?notrack=1), and only so that your visits are left out of the statistics.
• An administration marker — set only when the site owner signs in, so that her own visits are not counted. Never set for visitors.
• sudievu-count-off — not a cookie but one entry in your browser’s storage (localStorage), set only when you open any page with ?notrack (for example teatro.lt/?notrack) or when the owner signs in to the administration: the count.sudievu.lt visit counter then no longer counts your visits. ?track removes it.
• Until you press “Accept”, the Google Analytics script is not loaded at all — no request is sent to Google, so Google never sees your IP address. If you decline, it is never loaded.

6. Your rights (GDPR)

• Right to access, rectify and erase your data
• Right to restrict or object to processing
• Right to data portability

To exercise these rights, contact us: info@teatro.lt

7. Third parties

• Booking.com, Airbnb — reservation platforms
• Google LLC — Maps (the map in the contact section)
• Google LLC — Google Analytics (visitor statistics; only if you consent)
• OpenStreetMap Foundation (UK) — map tiles in the Klaipėda guide
• Stripe, Inc. — card payment processing
• CoinGate (Lithuania) — cryptocurrency payment processing
• Paysera LT, UAB (Lithuania) — bank-link payment processing
• sudievu.lt (the website’s developer) — the server in Lithuania on which the website, its database and the count.sudievu.lt visit counter run; from the counter it receives only what is listed in section 2 under “Visit counter”
• Cloudflare, Inc. — the network through which the website is reached: every request, including the details entered in the booking form, passes through its servers on the way to the website’s server
• UAB “Interneto vizija” — a server in Vilnius that holds a standby copy of the website and its database
• Telia Lietuva AB — e-mail

Stripe, Inc., Cloudflare, Inc. and Google LLC are established in the United States, so data may be transferred outside the EEA. Such transfers are made under the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

8. Contact and complaints

For privacy enquiries: info@teatro.lt. You may lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).