Privacy Policy

01Data controller

The data controller is the Žalesos pirtelė countryside retreat, located at Kalnų g. 29A, Varniškės (Ažulauke), Vilnius District, Lithuania (approximately 17 km from Vilnius).

For data protection matters, contact us through the website enquiry form or write to Kalnų g. 29A, Varniškės (Ažulauke), Vilnius District · 17 km from Vilnius.

02Data we process

Through this website we collect only the data needed to answer a reservation enquiry and arrange your stay:

• Reservation enquiry data: name, email address, phone number, selected house, check-in and check-out dates, number of guests, message and the fact that you consented to this Privacy Policy.
• Technical data: server logs necessary to keep the website secure and operational. We do not normally build a profile about you from this data.
• Analytics data (only with your consent): aggregated information about visits, device type, browser, page performance and approximate country. Analytics tools do not give us your name or contact details.
• Administrator login data: email, name and a password hash (passwords are never stored in plain text). This data is used only for administrative accounts.

We do not use automated decision-making or profiling that would have a legal effect on you.

03Purposes and legal basis

• To answer your reservation enquiry. Legal basis — your consent (Article 6(1)(a) GDPR), given via the mandatory consent checkbox. If the booking is confirmed, we process the data to perform the contract (Article 6(1)(b)).
• To protect the website and property and to establish or defend legal claims. Legal basis — our legitimate interests (Article 6(1)(f)).
• To comply with legal obligations (e.g. accounting). Legal basis — legal obligation (Article 6(1)(c)).
• To measure visits and improve the website. Legal basis — your consent (Article 6(1)(a)), which you can withdraw at any time.

04Retention periods

• Data from unconfirmed reservation enquiries is kept for 12 months from our last correspondence and then deleted.
• Confirmed booking data is kept for 3 years after departure so that legal claims can be made or defended; accounting documents, where created, are kept for the period required by Lithuanian law (usually 10 years).
• Analytics data is kept for a short period under the provider's retention policy and is normally used only in aggregate form.
• Your cookie preference is stored in your browser's local storage until you clear browser data or change your choice.

05Recipients

We do not sell or rent your personal data. Data may be processed only by the service providers we need to operate the website, acting on our instructions:

• Supabase — database and administrator authentication. More: supabase.com/privacy.
• Vercel — website hosting, performance and (with consent) analytics. More: vercel.com/legal/privacy-policy.
• Google — only if you click “Show the map” in the Contact section. Loading the map may transfer your IP address and device information to Google. More: policies.google.com/privacy.
• Public authorities — only where required by law or necessary to protect legitimate interests.

Where providers process data outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or another valid legal basis. We choose EU-region infrastructure where possible.

06Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate data or complete incomplete data;
• erase data where it is no longer necessary or is processed unlawfully (right to be forgotten);
• restrict processing; receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, use the website enquiry form or write to Kalnų g. 29A, Varniškės (Ažulauke), Vilnius District · 17 km from Vilnius. We will respond within 1 month; for complex requests this may be extended by a further 2 months, and we will inform you. We may ask you to verify your identity so that we do not disclose data to someone else.

If you believe your rights have been breached, you can contact the State Data Protection Inspectorate of Lithuania, vdai.lrv.lt, or your local supervisory authority. You are also always welcome to write to us first — most questions can be resolved directly.

07Cookies and analytics

The website uses essential cookies without which it could not operate securely (for example, administrator session cookies). These cookies are not used for marketing and do not require consent.

With your consent, we use Vercel Analytics and Speed Insights to measure visits and website performance. These tools help us understand which sections work well and what can be improved. We do not use advertising or cross-site tracking cookies.

You can change or withdraw your consent at any time using cookie settings, or by clearing your browser's local storage. Once consent is withdrawn, analytics tools will no longer load.

The Google map in the Contact section loads only after you click “Show the map”, so third-party content is not loaded without your action.

08Security

We apply technical and organisational measures: HTTPS encryption, role-based access control for administration, service keys kept server-side only, password hashing and data minimisation. Only authorised staff can access enquiries.

If a personal data breach were to occur that poses a high risk to your rights, we would inform you and, where required, notify the supervisory authority.

09Children's privacy

This website is intended for adults. We do not knowingly collect personal data from children under 18. If a minor makes a booking, it should be made with the consent of a parent or guardian. If we learn that we have received a child's data without a proper basis, we will delete it.

10Policy updates

We may update this policy if the law or our data practices change. The new version will be published on this page with an updated date. Where changes are significant and we hold your contact details, we may notify you separately where appropriate.

11Contact us

For any privacy questions, requests or concerns, please contact us:

You can change your cookie preference at any time in cookie settings. If anything is unclear, contact us through the enquiry form.