Legal

Privacy policy

This policy explains what personal data MB „Etapai“ collects, the purposes and legal bases for processing it, who we share it with and what rights you have.

Last updated: 18 August 2026

1. General provisions

The controller of your personal data is MB „Etapai“, company code 307566317, registered address Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania, email info@etapai.lt, phone +370 647 33266 (“Etapai” or “we”).

This privacy policy applies to the etapai.lt website and to the Etapai project management platform (together, the Services).

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications and other applicable legislation.

We have not appointed a data protection officer, as our activities do not meet the criteria set out in Article 37 of the GDPR. For any question about personal data, write to info@etapai.lt.

2. Definitions

Personal data: any information relating to an identified or identifiable natural person.
Controller: MB „Etapai“, which determines the purposes and means of processing personal data.
Processor: a service provider that processes data on our behalf and on our instructions.
User: a person who has created an Etapai account and uses the platform.
Visitor: a person who browses etapai.lt without an account.
Cookie: a small text file that your browser stores on your device when you visit the website.

3. What data we collect and why

We only collect the data needed for a specific purpose. The categories below set out the data, the purposes, the legal bases and the retention periods.

Account data

First name, last name, email address, phone number, a cryptographic hash of your password, account settings.

Purpose: To create and administer your account, give you access to the platform and contact you about the Services.
Legal basis: Performance of a contract with you (GDPR Art. 6(1)(b)).
Retention period: While the account is active and for 12 months after it is deleted.

Project content

Project and stage names, tasks, deadlines, budgets and spending, documents, photos, invoices, comments and messages, and the contact details of contractors and other project participants that you enter yourself.

Purpose: To provide the platform features: managing project stages, deadlines, budgets, documents and participants.
Legal basis: Performance of a contract with you (GDPR Art. 6(1)(b)).
Retention period: While the account is active. After a project or account is deleted, data is also removed from backups within 30 days.

Technical and usage data

IP address, browser and device type, operating system, language, visit time, pages viewed, referring source, error reports.

Purpose: To keep the Services running and secure, diagnose errors, measure website usage and improve it.
Legal basis: Our legitimate interest in operating and securing the Services (GDPR Art. 6(1)(f)). For statistics and marketing cookies — your consent (GDPR Art. 6(1)(a)).
Retention period: Server and security logs up to 12 months. Google Analytics data up to 14 months.

Enquiry data

Name, email address, phone number and the content of your message when you contact us by email or phone.

Purpose: To answer your enquiry, advise you and keep a record of our correspondence.
Legal basis: Our legitimate interest in responding to enquiries (GDPR Art. 6(1)(f)), or steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).
Retention period: Up to 12 months after the correspondence ends.

Billing and accounting data

Payer details, invoices, payment history, the plan you have chosen.

Purpose: To issue invoices, keep accounting records and meet tax obligations.
Legal basis: Legal obligation (GDPR Art. 6(1)(c)) and performance of a contract (GDPR Art. 6(1)(b)).
Retention period: 10 years, as required by Lithuanian accounting and document retention legislation.

Marketing data

Name and email address, subscription preferences, information about email opens.

Purpose: To send newsletters and information about Etapai news and features.
Legal basis: Your consent (GDPR Art. 6(1)(a)), or our legitimate interest in informing existing customers about similar services (GDPR Art. 6(1)(f)).
Retention period: Until you withdraw consent or object.

You provide personal data voluntarily. Without account or billing data we cannot enter into a contract and provide the Services.

If you add other people’s data to a project — for example contractors, tradespeople or family members — you are responsible for having a legal basis to provide it and for making sure those people know their data is processed on the platform.

We do not knowingly collect special categories of personal data (GDPR Art. 9, such as health or political opinions) and ask you not to submit them through the platform. We do not make automated decisions producing legal effects concerning you, and we do not profile you for such purposes.

Once a retention period ends, data is securely deleted or anonymised so that you can no longer be identified.

4. Cookies and analytics

We use necessary cookies on the website and, only with your consent, analytics cookies. We do not use marketing cookies or advertising trackers on this website.

The necessary “etapai-consent” cookie remembers your choice. It is not used for analytics or advertising and does not require consent.
Google Analytics 4 and its script load only after you consent to analytics. Until then, this website makes no analytics requests to Google.
If you withdraw consent, we stop future analytics events and remove Google Analytics cookies accessible to this website. Data already transmitted by the browser cannot be recalled.
You can change or withdraw your consent at any time via “Cookie settings” in the website footer. You can also delete or block cookies in your browser settings — some website features may then work only partially.

After this change the website uses the cookies listed below. Google Analytics entries appear only after analytics consent.

Name	Provider	Purpose	Category	Lifetime
`etapai-consent`	MB “Etapai” (Klaro library)	Stores the consent settings you selected.	Necessary	180 days
`_ga`	Google Analytics (etapai.lt domain)	Distinguishes website visitors in statistics reports.	Analytics	Up to 2 years
`_ga_D6ZCK33VX8`	Google Analytics (etapai.lt domain)	Stores and counts the state of a visit session.	Analytics	Up to 2 years

5. Who we share data with

We do not sell your personal data and do not share it with third parties for their own marketing purposes.

To provide the Services we use processors that act only on our instructions and with whom we have signed data processing agreements:

Cloudflare, Inc. — website hosting, content delivery network and protection against attacks;
Google Ireland Limited — Google Analytics website usage statistics;
providers of cloud infrastructure, email and customer support tools;
providers of accounting, audit and legal services.

We may also disclose data to courts, law enforcement or supervisory authorities where required by law or where necessary to protect our legitimate interests.

6. Transfers outside the EEA

We aim to process data within the European Economic Area (EEA). Some service providers may process data outside the EEA.

In such cases transfers only take place with appropriate safeguards: under a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or under the Standard Contractual Clauses approved by the European Commission together with supplementary technical and organisational measures. To receive information about the safeguards in place, write to info@etapai.lt.

7. Data security

We apply technical and organisational measures to protect data against loss, unauthorised use, disclosure or alteration:

data is transmitted between your browser and our servers over an encrypted HTTPS/TLS connection;
passwords are stored only as cryptographic hashes — we cannot see or restore them;
access to data is granted only to those employees and processors who need it to do their work, and they are bound by confidentiality obligations;
we take regular backups, keep systems updated and monitor for unusual activity.

No method of transmission over the internet or of storage is completely secure, so we cannot guarantee absolute security. If you notice a possible vulnerability, please report it to info@etapai.lt.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the State Data Protection Inspectorate as required by law.

8. Direct marketing

We send newsletters and offers only with your prior consent. We may send existing customers information about our similar services on the basis of legitimate interest, as provided by the Law on Electronic Communications.

You can withdraw your consent at any time using the unsubscribe link at the bottom of the email or by writing to info@etapai.lt. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you opt out of marketing messages, we will still send service-related technical and administrative notices — for example about account changes or invoices.

9. Your rights

The GDPR gives you the following rights:

to access your personal data and information about how we process it;
to have inaccurate data corrected and incomplete data completed;
to have your data erased (the “right to be forgotten”) where there is no longer a legal basis for processing it;
to restrict processing while your request or the accuracy of the data is being verified;
to receive the data you provided in a structured, machine-readable format and to have it transferred to another controller;
to object to processing based on our legitimate interest, and to direct marketing;
to withdraw your consent at any time;
to lodge a complaint with a supervisory authority.

To exercise your rights, write to info@etapai.lt. To protect your data we may ask you to confirm your identity. We reply within one month of receiving your request; in complex cases this may be extended by a further two months, and we will tell you if that happens. Requests are handled free of charge.

If you believe we have infringed your rights, please contact us first — we will try to resolve the matter. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania, L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, phone +370 5 271 2804, vdai.lrv.lt.

10. Children’s data

The Services are intended for adults and are not directed at people under 16. We do not knowingly collect their data. If we learn that data of a person under 16 has been provided without the consent of a parent or guardian, we delete it without delay.

11. Changes to this policy

We may update this privacy policy as the Services or legal requirements change. The current version is always published on this page together with the date it was last updated.

We will inform registered users about material changes by email or through a notice in the platform before they take effect. We recommend reviewing this page from time to time.

12. Contact us

Do you have questions about this policy or want to exercise your rights? Get in touch:

MB „Etapai“: company code 307566317
Address: Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania
Email: info@etapai.lt
Phone: +370 647 33266