$ cat ./privacy-policy.md
Privacy Policy
How MB „Founders Lab“ collects and uses personal data when you visit our website, contact us, work with us or hear from us.
Contents
1Who we are
MB „Founders Lab“ (“Founders Lab”, “we”, “us”) is a small partnership (mažoji bendrija) registered in the Republic of Lithuania, company code 307723131. We design and build websites, company systems and SEO for businesses.
We are the controller of the personal data described in this policy. For anything about it, email info@founderslab.lt.
We have not appointed a data protection officer, because the law does not require one for our activities.
2What this policy covers
This policy applies when you:
- visit founderslab.lt or another page of ours that links to this policy (the “website”);
- email us, talk to us on a call or meet us;
- are our client, or work for a business that is our client, supplier or partner;
- receive a message from us about our services because your business contact details are public.
It does not apply to:
- Data we handle for our clients. When we build, host or maintain a website or system for a client, such as a booking form or a customer list, the client decides how that data is used and is its controller. We act on the client’s instructions as a processor, under a separate agreement. If your data is in a client’s system, contact that client. Each client is responsible for its own privacy practices.
- Other websites and services, including websites we built for clients and sites we link to. Their own policies apply.
3What we use, why, and on what legal basis
We use personal data only for the purposes below. Where we rely on our legitimate interests, we have weighed them against your rights and freedoms, and you can object at any time (see section 8).
3.1Visiting the website
- What
- Your IP address, browser and device type, the pages and files requested, the page you came from and the time of each request. Your browser sends these automatically.
- Why
- To deliver the website, keep it secure, prevent abuse, and find and fix faults.
- Legal basis
- Our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)).
- How long
- Our hosting provider keeps server logs for a short period under its own retention rules. We do not use them to identify you unless we need to investigate a security incident or abuse.
3.2Your language choice
- What
- If you press EN or LT, your browser saves that choice on your device under the name
fl-lang. Without it, the website follows your browser’s language setting. - Why
- So the website opens in the language you chose.
- Legal basis
- This storage is strictly necessary for a function you asked for, so Lithuanian electronic communications law does not require consent for it. The saved choice is never sent to us.
- How long
- Until you clear your browser’s data for this website.
3.3Fonts and code from other servers
- What
- When the website loads, your browser requests fonts from Google Fonts, run by Google, and the three.js 3D library from the jsDelivr network. These providers receive your IP address and browser details with each request and handle them under their own privacy policies. We do not receive this data.
- Why
- To show the website with its typefaces and 3D scene, quickly and reliably.
- Legal basis
- Our legitimate interest in presenting the website properly (Article 6(1)(f)).
- How long
- Set by each provider’s own policy.
3.4Concept demos
- What
- Some portfolio projects are working demos of fictional businesses, such as the REBOUND clinic and the AETHER X1 watch. What you enter in them, such as a test booking or a screen-size setting, is saved only in your own browser so the demo can show it back to you. We do not receive or store it. Please do not enter real personal, health or payment details.
- Why
- To make the demo work.
- Legal basis
- Strictly necessary for the demo you chose to use. Nothing is sent to us.
- How long
- Until you clear your browser’s data for the website. Where a demo is hosted on another platform, that platform’s policy also applies.
3.5Emails and enquiries
- What
- Your name, email address, phone number if you give it, your business and role, what you write and any files you send.
- Why
- To answer you, understand what you need and prepare a proposal.
- Legal basis
- Steps taken at your request before entering into a contract (Article 6(1)(b)). Where you write on behalf of a business, our legitimate interest in handling business enquiries (Article 6(1)(f)).
- How long
- If no project follows, up to 24 months after our last contact, so we have the context if you come back. Then we delete it.
3.6Calls and meetings
- What
- Your name, email address, the meeting invitation and what we discuss, including our notes. Calls take place on Google Meet. We do not record calls unless we ask first and everyone on the call agrees.
- Why
- To hold the call, understand your project and follow up.
- Legal basis
- As in 3.5. For a recording, your consent (Article 6(1)(a)), which you can withdraw at any time.
- How long
- Notes as in 3.5. Recordings are deleted within 90 days unless they become part of a project file.
3.7Clients
- What
- Names, roles and contact details of the people we work with, project communication, feedback and approvals, files and access details you share for the project, and invoices and payment records.
- Why
- To deliver the work we agreed, manage the project, invoice, collect payment and keep records.
- Legal basis
- Performing our contract (Article 6(1)(b)). For people who work at a client business, our legitimate interest in working with the people it assigns (Article 6(1)(f)). Our legal obligations under tax and accounting law (Article 6(1)(c)).
- How long
- For the project, and afterwards until claims about it can no longer be brought (in Lithuania, generally up to 10 years). Accounting documents for as long as Lithuanian law requires (currently 10 years).
3.8Businesses we contact
We contact businesses that we think could use our services, usually by email.
- What
- Business name, website, business email address and phone number, the name and role of a contact person where they are published, city and industry, our notes about the business’s public website (such as an audit or a design idea we prepared) and the history of our messages.
- Source
- Public sources: the business’s own website, public business registers and directories, and search and map listings.
- Why
- To offer our services to businesses that may need them, and to keep track of who we contacted so we do not repeat ourselves.
- Legal basis
- Our legitimate interest in promoting our services to businesses (Article 6(1)(f)). We send business marketing emails only as Lithuanian electronic communications law allows, and every one of them lets you opt out.
- Your choice
- Reply “stop” or use the unsubscribe option in any of our emails, and we stop. We then keep only your email address, business name and the date on a do-not-contact list, so that we never contact you again.
- How long
- Up to 12 months after our last message if you do not reply. The do-not-contact list for as long as we send business outreach.
3.9Suppliers and partners
- What
- Names and business contact details of people at our suppliers, subcontractors and partners, and our communication with them.
- Why
- To work with them and manage the relationship.
- Legal basis
- Performing our contract (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)).
- How long
- For the relationship, and afterwards until claims can no longer be brought.
3.10Protecting our rights
We may use any of the data above where needed to establish, exercise or defend legal claims, collect unpaid amounts, prevent fraud or abuse, keep our systems secure or respond to lawful requests from authorities. The legal basis is our legitimate interests (Article 6(1)(f)) and our legal obligations (Article 6(1)(c)). We keep the data needed for this until the matter is resolved and any time limits for claims have passed.
When a retention period ends, we delete the data or make it anonymous. Copies in backups are removed in the normal backup cycle.
4Do you have to give us data?
No. But we cannot reply without contact details, and we cannot work with you without the information a contract needs, such as invoicing details. Tax and accounting law requires some of it.
6Transfers outside the EEA
Most of our data is stored in the European Economic Area. Some providers, such as Google and GitHub, may process it in the United States or other countries. When data leaves the EEA, we rely on a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified companies, or on the Commission’s Standard Contractual Clauses. You can ask us for details of these safeguards.
7How we protect data
We use technical and organisational measures that suit a business of our size: access only for the people who need it, encrypted connections, and providers with recognised security standards. No way of sending or storing data is completely secure, so we cannot guarantee absolute security.
Email is not end-to-end encrypted. Please do not send us passwords, health information or other sensitive data by email. If we need access to your systems, we will agree a secure way to share it.
If a personal data breach is likely to put your rights at risk, we will notify the State Data Protection Inspectorate, and you where the law requires.
8Your rights and how to complain
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased, in certain cases;
- restrict how we use it, in certain cases;
- receive data you gave us in a portable format, where we process it by automated means based on your consent or a contract;
- object to processing based on our legitimate interests, and to direct marketing at any time, in which case we stop;
- withdraw your consent at any time, without affecting what we did before.
To use your rights, email info@founderslab.lt. We reply within one month. For complex or numerous requests, we may extend this by two more months and will tell you why. We may ask you to confirm your identity first. If a request is manifestly unfounded or excessive, in particular because it repeats, we may charge a reasonable fee or refuse it, as the GDPR allows. Some rights have limits: for example, we may keep data that the law requires us to keep or that we need for a legal claim.
You also have the right to complain to the supervisory authority. In Lithuania that is:
Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate)L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
ada@ada.lt · vdai.lrv.lt
You can also complain in the EU country where you live or work. We would appreciate the chance to resolve your concern first, so please contact us before you complain if you can.
9Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
10Children
Our website and services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, contact us and we will delete it.
12Other websites
The website links to other websites, such as our clients’ websites and demos hosted on other platforms. We do not control them and are not responsible for their content or privacy practices. Read their policies when you visit them.
13Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change significantly affects how we use data you have already given us, and we have your email address, we will tell you by email.
This policy is published in English and Lithuanian. If the versions differ, the English version prevails, unless the law requires otherwise.
14Contact us
MB „Founders Lab“Company code 307723131
Lithuania
info@founderslab.lt