Privacy policy | SMEIVIS

Last updated: 2026-11-13

This policy explains how SMEIVIS handles personal data when you use this website, the contact form or the client area. It follows the General Data Protection Regulation (GDPR, EU 2016/679) and the Lithuanian Law on Legal Protection of Personal Data.

1. Who is responsible for your data

Data controller: SMEIVIS, ‹full name or company name›, ‹business licence or company code›, ‹address›. Privacy contact: ‹email address›.

2. What we collect and why

Contact form

When you write via the contact form we receive your name, email address, phone number (if you give it), the service you are interested in and your message. We use this only to answer your enquiry and prepare a proposal.

Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)). Kept for no longer than 24 months after our last exchange, unless we enter into a contract.

Client area

When you create an account you provide your full name and email address, and optionally your phone number, company and preferred email language. We also record when you accepted this policy. There is no password: you sign in with a one-time code we email you. We store only a hashed fingerprint of the code (never the code itself), and only for the 15 minutes it is valid.

The client area also stores your project messages and revision requests, the files you heart and the project files delivered to you (photos, video, design files). For some clients we may keep short internal notes related to the project.

If we send you a questionnaire (e.g. for wedding filming), we keep what you enter in it: dates, places, the day plan, important people, wishes and attached files. It is used only to plan your project and is deleted together with the project.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)). Account data is kept while the account is in use and deleted at your request. Project files are available until the expiry date set on the project (usually 1 month from upload); after that access ends, and 7 days later the files are deleted from storage.

Reviews

If you leave a review we keep its text, your name and (if given) your role or company. We publish it only with your explicit consent and after reviewing it. Legal basis: consent (GDPR Art. 6(1)(a)); you can withdraw it at any time and we will remove the review.

Emails

Client-area users only receive service emails: sign-in codes and notices about new messages, files ready, questionnaires and files about to expire. We do not send newsletters or marketing emails.

Technical data

Like any server, ours briefly records technical request data (IP address, time, browser type). This is needed for security and troubleshooting (legitimate interest, GDPR Art. 6(1)(f)) and kept for no longer than 30 days.

Visitor statistics

We count page views, which site you came from (its name only) and whether you use a phone, tablet or computer. We use no cookies or browser storage for this and store no IP addresses: only daily totals are kept, from which no visitor can be identified. If your browser sends Do Not Track or Global Privacy Control, your visits are not counted. Legal basis: legitimate interest in understanding how the site is used (GDPR Art. 6(1)(f)).

3. What we do not do

We use no third-party tracking or analytics tools (such as Google Analytics or Meta Pixel).
We use no advertising cookies and do not profile visitors.
We do not sell data or share it for marketing.
We make no decisions based solely on automated processing.
Fonts and YouTube thumbnails are served from our own server, so showing them makes your browser contact no one at Google.

4. Cookies and browser storage

Necessary (the site does not work without them, so no consent is needed):

smeivis_client: keeps you logged in to the client area. Lasts until you close the browser, or 30 days with "Keep me logged in".
smeivis_consent: your cookie choice. Lasts 12 months.
NEXT_LOCALE: the site language you chose. Lasts until you close the browser.
Browser storage (not cookies) remembers your theme (light or dark), whether you have seen the intro animation, and whether you dismissed the prompt to install the client area on your phone.

External media (only with your consent): portfolio videos are served by YouTube (Google Ireland Ltd.) in its privacy-enhanced youtube-nocookie.com mode, and the contact map by OpenStreetMap. Until you agree, this content is not loaded and no data is sent to these providers. You can change your choice any time via "Cookie settings" at the bottom of the site.

5. Who can see the data

We process the data ourselves. To run the site we use these service providers (processors), who handle data only on our instructions:

Server hosting: ‹Kvintera, UAB (Lithuania)›, which runs the website and database.
File storage: ‹Cloudflare, Inc., R2 storage in EU data centres›, which stores client project files.
Email delivery: ‹email service provider›.

Where a provider is outside the European Economic Area (e.g. Cloudflare, Inc., USA), data is transferred only with the safeguards the GDPR requires: the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

6. How we protect data

All connections to the site are encrypted (HTTPS).
Clients sign in without a password, with a one-time email code: valid for 15 minutes, usable once, and void after 5 wrong tries.
Project files live in private storage; download links are created only for the logged-in client and expire.
Each client sees only their own projects and files.

7. Your rights

You have the right to:

access your data and get a copy of it;
have inaccurate data corrected (some of it you can change yourself in your client-area account);
have your data erased ("right to be forgotten");
restrict or object to processing;
receive your data in a structured, machine-readable format (portability);
withdraw consent at any time (e.g. for publishing a review or for external media), without affecting processing done before.

To exercise your rights, email ‹email address›. We reply within one month. If you believe your data is processed unlawfully, you can complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or the authority in your country.

8. Do you have to provide data

No. You can browse the site without giving any data. A name and email are only needed to answer your enquiry or create a client account.

9. Changes

We update this policy when the site or the law changes. The current version is always on this page, with the update date at the top.