Privacy policy

Last updated: 11 September 2026

This Privacy Policy explains how Jolanta Šindeikienė (hereinafter – the Data Controller or we) collects and processes personal data when you visit the website jolantasindeikiene.lt, contact us, register for a consultation, programme or seminar, make a payment or use our services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter – GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania, and other applicable legal acts.

1. DATA CONTROLLER AND CONTACT DETAILS

Data Controller: Jolanta Šindeikienė

Form of business activity: individual activity under certificate No. 704616

Website: jolantasindeikiene.lt

Email for privacy matters: info@jolantasindeikiene.lt

Telephone: +370 682 43651

Business / correspondence address: Varnikų g. 4, Varnikų k., Trakų r.

If a Data Protection Officer has been appointed, their contact details are published in this section. Currently, a Data Protection Officer has not been appointed.

2. WHAT DATA WE PROCESS, FOR WHAT PURPOSES AND ON WHAT GROUNDS

Responding to enquiries

Data processed: name, email address, telephone number (if provided), subject, message content, correspondence data.

Legal basis: our legitimate interest to respond to an enquiry (Article 6(1)(f) of the GDPR); when contacting regarding a service – steps prior to entering into a contract (Article 6(1)(b) of the GDPR).

Retention period: up to 12 months from the final response, unless the data is required longer to resolve a dispute or fulfil a legal obligation.

Registering for a consultation, programme or seminar and administering the order

Data processed: name, surname, email, telephone, selected service, date and time, registration and communication data, other data provided during registration.

Legal basis: conclusion and performance of a contract (Article 6(1)(b) of the GDPR).

Retention period: during the term of the contract and provision of services, and for up to 3 years after its termination, taking into account the limitation periods for potential claims.

To provide individual consultations and programmes

Data processed: contact details, meeting history, information voluntarily provided by the client, notes necessary to provide the service.

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR); where data concerning health, emotional or psychological condition is provided – explicit consent (Article 6(1)(a) and Article 9(2)(a) of the GDPR).

Retention period: during the provision of the service and for no longer than 1 year after the last session, except for data required to be retained longer, or until consent is withdrawn, provided there is no other basis for retaining it.

To accept and account for payments

Data processed: name, surname, order and payment amount, date, payment status, details required for invoicing; we do not receive full payment card details.

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR) and legal obligation to maintain accounting records (Article 6(1)(c) of the GDPR).

Retention period: accounting documents – for the period established by legal acts, usually 10 years.

To organise remote sessions and participant groups

Data processed: name, contact and login details, image, voice, and messages, if the participant chooses to share them.

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR); recording – only with prior consent (Article 6(1)(a) of the GDPR).

Retention period: during the period of participation; recordings – for the period specified in the consent.

To send newsletters and offers

Data processed: name, email address, consent details, email delivery, open and link-click data.

Legal basis: consent (Article 6(1)(a) of the GDPR and requirements of the Law on Electronic Communications).

Retention period: until consent is withdrawn or for 2 years from the last active interaction; proof of consent may be retained for a further 3 years.

To ensure website functionality and security

Data processed: IP address, device and browser details, request time, URLs visited, technical event and security logs.

Legal basis: legitimate interest in ensuring the security and functionality of the website (GDPR Article 6(1)(f)).

Retention period: generally up to 30 days, and in the case of security incident data – until the investigation of the incident and the expiry of legal claim limitation periods.

Evaluate traffic, advertising, and communication effectiveness

Data processed: cookie identifiers, IP address and approximate location data, device and browsing information, interaction with content and emails.

Legal basis: prior consent (GDPR Article 6(1)(a)).

Retention period: according to the settings of the specific cookie or tool, but no longer than specified in the cookie management banner.

Defend rights and resolve disputes

Data processed: data and documents related to the specific claim.

Legal basis: legitimate interest in establishing, exercising, or defending legal claims (GDPR Article 6(1)(f); if it is necessary to process special category data – GDPR Article 9(2)(f)).

Retention period: until the final resolution of the dispute and the expiry of the applicable statutory limitation period.

Where data is necessary to conclude a contract or comply with a legal obligation, failure to provide it may result in us being unable to accept your registration, provide the service, or issue an accounting document. Data whose provision is optional will be clearly marked as such in the relevant form.

3. SENSITIVE DATA

The nature of the consultations means that you may voluntarily disclose information regarding your health, emotional or psychological state, traumatic experiences, or other aspects of your private life. Please do not provide more sensitive information in contact or public registration forms than is necessary for registration.

We process such special categories of data only with your explicit consent when it is necessary to provide the selected service. You may withdraw your consent at any time; however, this does not affect the lawfulness of processing carried out prior to the withdrawal. If it is objectively impossible to provide the specific service without this data, its provision may have to be terminated following the withdrawal of consent.

The consultations and methods offered on the website are not a substitute for licensed medical, psychiatric, or emergency care where such assistance is needed.

4. SOURCES OF DATA

Most often, we obtain data directly from you: when you fill in a form, register, make a payment, communicate with us, or take part in a service. Technical data is automatically collected by the website and, only with the required consent, by selected analytics or marketing tools. We may receive payment confirmation details from the payment service provider. If another person registers you for an event, they must have the right to provide your data and must inform you about this policy.

5. WHO WE MAY DISCLOSE DATA TO

To the extent necessary for a specific purpose, data may be processed by:

• website hosting and technical maintenance service providers, including Hostinger;
• website, form, and registration system providers, including “WordPress”, “Elementor”, “Fluent Forms”, and “Amelia”;
• payment service provider “Stripe” and financial institutions involved in the payment;
• email, newsletter, and marketing automation service providers, including “Omnisend”;
• analytics and tag management service providers, including “Google” (“Google Tag Manager” and services activated through it);
• remote communication or event platforms, such as “Zoom” and closed “Facebook” groups, when used for the selected service;
• accounting, legal, IT security, and other professional service providers;
• state authorities, courts, or law enforcement bodies when disclosure of data is mandated by legislation.

When clicking a link to “Facebook”, “Instagram”, “YouTube”, “TikTok”, “Telegram”, or another external platform, further data processing is determined by the controller of that platform. Before using it, please familiarise yourself with the relevant platform’s privacy information.

We only transfer to service providers as much data as is necessary to perform their functions and, where necessary, enter into data processing agreements compliant with Article 28 of the GDPR.

6. DATA TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some technology providers, such as “Google”, “Meta”, “Stripe”, “Zoom”, or “Omnisend”, may process data outside the European Economic Area, including the United States of America. In such cases, data is transferred only on a basis provided for in Chapter V of the GDPR: a European Commission adequacy decision, EU–US Data Privacy Framework certification, European Commission standard contractual clauses, and, where necessary, supplementary protection measures.

You may request information about the safeguard applied to a specific transfer, or a copy thereof, by writing to the email address specified in Section 1. Commercial or confidential parts of documents may be redacted.

7. COOKIES AND SIMILAR TECHNOLOGIES

The website uses:

• essential cookies required for the site, security, registration, payment, and your privacy choices;
• functional cookies that remember your selected settings;
• analytical cookies that help understand website usage;
• marketing cookies and tracking technologies used to evaluate the effectiveness of advertising and communication.

Essential cookies are used without consent when strictly necessary for a service explicitly requested by you or to transmit a communication. All other cookies, “Google Tag Manager” tags, “Omnisend” tracking, embedded third-party content, or similar technologies must only be activated with your prior consent.

On your first visit, a cookie preferences window must be displayed, where you can equally easily agree, refuse, or select categories. Consent can be withdrawn or amended at any time by clicking the permanently visible “Cookie Settings” link. Withdrawal does not affect the lawfulness of data processing carried out prior to it.

The exact name, provider, purpose and expiry period of the cookies currently in use are provided in the website's cookie management window. You can also delete cookies already stored in your browser, but this does not replace the obligation to manage consent on the website.

8. NEWSLETTERS AND DIRECT MARKETING

We only send newsletters or offers upon receiving separate, freely given consent, with the exception of narrow exemptions explicitly permitted by law for existing clients. Agreement to the privacy policy does not constitute consent to receive marketing. Every marketing email contains an unsubscribe link; you can also contact us by email at info@jolantasindeikiene.lt.

Registration for a consultation, workshop or other service cannot be conditioned upon mandatory consent to receive marketing, unless marketing is necessary to provide that service.

9. DATA SECURITY

We apply risk-appropriate technical and organisational measures designed to protect data against unauthorised access, loss, alteration or disclosure. Access is granted only to those individuals who require it to perform their work duties. Although we take reasonable security measures, no method of data transmission or storage can guarantee absolute security.

10. YOUR RIGHTS

In the cases established by the GDPR, you have the right to:

• obtain information and access your personal data;
• request the rectification of inaccurate data and the completion of incomplete data;
• request the erasure of data;
• request the restriction of data processing;
• receive the data you provided in a structured, commonly used and machine-readable format and request its transmission to another controller, where applicable;
• object to the processing of data based on legitimate interests, including the right to object to direct marketing at any time;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing which produces legal or similarly significant effects;

We currently do not make decisions based solely on automated data processing that would produce legal or similarly significant effects on you.

To exercise your rights, please contact us by email at info@jolantasindeikiene.lt. We may request information necessary to reasonably verify your identity, but we will not ask for more data than is required for that purpose. We will usually respond within one month. Depending on the complexity and number of requests, this period may be extended by a further two months, in which case you will be informed of this and the reasons within the first month.

Teisės nėra absoliučios ir gali būti ribojamos teisės aktuose nustatytais atvejais. Jei manote, kad jūsų duomenys tvarkomi neteisėtai, pirmiausia kviečiame kreiptis į mus. Taip pat turite teisę pateikti skundą Valstybinei duomenų apsaugos inspekcijai, L. Sapiegos g. 17, LT-10312 Vilnius, el. paštas ada@ada.lt, svetainė vdai.lrv.lt (https://vdai.lrv.lt/).

11. CHILDREN'S DATA

The website and services are not intended for individuals under 18 years of age, unless explicitly provided otherwise in advance for a specific service and the legally required parental or guardian consent has been obtained. If we knowingly collect a child's data without a proper legal basis, we will delete it.

12. EXTERNAL WEBSITES AND PLATFORMS

The website may contain links to third-party websites or platforms. We are not responsible for their privacy practices. This policy applies solely to our data processing.

13. CHANGES TO THE POLICY

We may update this policy if our services, technologies used, or legislation change. The latest version is always published on this page, indicating the update date. Where reasonably feasible and necessary, we will provide additional notice regarding any material changes.