Privacy policy

Last updated: 3 November 2026

This policy describes the personal data UAB Energy Advice processes when you use energyadvice.lt: when you write to us through the contact form, register for a training, pay for it or subscribe to the newsletter.

1. Controller

UAB Energy Advice, company code 303038190, VAT code LT100009883411, Žemaičių g. 31-233, LT-44175 Kaunas, Lithuania. Email info@energyadvice.lt, phone +370 635 16380.

2. What we collect and why

Contact form enquiries

Data: name, email address, phone number and company (if you give them), message.
Purpose: to answer your enquiry.
Legal basis: our legitimate interest in answering you, or steps before entering into a contract when you ask about our services (GDPR Art. 6(1)(f) and (b)).
Retention: the enquiry reaches us by email; we keep it for 15 days after the last exchange.

Training registration

Trainings are booked by companies. We process data about the company and its representatives.

Data: company name, company code, VAT code, address; the contact person’s name, email address and phone number; participants’ names and email addresses; your comment (if any); the chosen payment method and the language of the registration.
Purpose: to accept the registration, issue the advance invoice, send confirmations and training information (such as schedule changes), and manage the waiting list.
Legal basis: entering into and performing the contract with your company, and our legitimate interest in organising the training for its representatives and participants (GDPR Art. 6(1)(b) and (f)); for invoices, our legal obligation to keep accounting records (GDPR Art. 6(1)(c)).
Retention: participant and contact person details are kept for 5 years after the training and then anonymised. Invoices and other accounting records are kept as long as Lithuanian law requires (10 years).

Card payments

If you choose to pay by card, you are taken to a Stripe payment page. Stripe processes your card details; we never receive or store them. Stripe only tells us whether the invoice has been paid.

Legal basis: performing the contract (GDPR Art. 6(1)(b)).

Data: email address and language.
Purpose: to send news about trainings, events and our work.
Legal basis: your consent (GDPR Art. 6(1)(a)). You confirm the subscription by clicking the link in our email. You can withdraw consent at any time through the unsubscribe link in any newsletter or by writing to us.
Retention: until you unsubscribe.

Bot protection and website security

The contact and registration forms use Cloudflare Turnstile, a check that a person is filling in the form. It looks at browser and device signals. Like any web server, ours logs requests (IP address, time, the page requested, browser type).

Legal basis: our legitimate interest in protecting the website and its forms from abuse (GDPR Art. 6(1)(f)).
Retention: server logs are capped in size (up to 1 GB); once the cap is reached, the oldest entries are deleted automatically.

3. Who receives your data

We do not sell your data. Only these service providers process it, each solely to provide its service:

Hetzner Online GmbH (Germany) – servers for the website, the content management system and the newsletter system;
Serveriai.lt (Lithuania) – sending emails (confirmations, invoices, replies to enquiries);
invoice123 – issuing advance invoices;
Stripe (Stripe Payments Europe, Ltd., Ireland) – card payments;
Cloudflare, Inc. (USA) – the Turnstile check on forms.

We may also disclose data to public authorities where the law requires it.

Cloudflare and Stripe may process data outside the European Economic Area, in the USA. Such transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

4. Cookies

The website uses no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

Cloudflare Turnstile runs only on pages with forms and is necessary to protect them.
When you pay by card, Stripe uses its own cookies on its own page (stripe.com) under the Stripe privacy policy.
Links to LinkedIn and YouTube take you to those sites; their rules apply when you visit them.

If we start using analytics or other non-essential cookies, we will ask for your consent first and update this policy.

5. Your rights

You have the right to:

know whether and which of your data we process, and get a copy;
have inaccurate data corrected;
have data erased when it is no longer needed or is processed unlawfully (except data the law requires us to keep);
have processing restricted;
object to processing based on our legitimate interest;
receive the data you gave us in a structured format and pass it to another controller;
withdraw consent at any time (this does not affect processing before the withdrawal).

Send requests to info@energyadvice.lt. We answer within one month.

If you believe your data is processed unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or to the data protection authority of the EU country where you live.

6. Security

Only authorised staff administer the servers that hold the data. Backups are made every night; deleted or anonymised data stays in them for no more than 15 days. Connections to the website are encrypted (HTTPS). We do not make decisions with legal effects on you by automated means alone.

7. Changes

When this policy changes, we publish the new version on this page with its update date.