1. Who is responsible for your data

AIVA Web Design Agency ("AIVA", "we", "us") is the data controller responsible for the personal data described in this policy. This means we decide why and how your personal data is processed.

This policy applies to personal data we collect through our website, our contact and proposal forms, email correspondence, and the delivery of our website design and conversion-optimisation services.

2. The personal data we collect

Information you give us. When you submit a contact form, request a proposal or work with us, we collect your name, email address, and optionally your company name and budget range, together with the content of your message and any information you send us during the project.

Information collected automatically. When you visit our website, our hosting and analytics providers may collect technical data such as your IP address, browser type, device information, the pages you view and the time and date of your visit.

We do not intentionally collect special-category data (such as health, religious or political information) and ask that you do not include it in your messages to us.

3. How and why we use your data, and our legal bases

We process your personal data for the following purposes and on the following legal bases under the EU General Data Protection Regulation (GDPR):

Responding to your enquiry and preparing a proposal — necessary to take steps at your request before entering a contract (GDPR Article 6(1)(b)).

Delivering and managing the Services, issuing invoices and providing support — necessary for the performance of our contract with you (Article 6(1)(b)).

Keeping business records, preventing fraud and complying with tax and accounting obligations — necessary for compliance with a legal obligation (Article 6(1)(c)).

Improving our website and services, and — where permitted — sending you relevant marketing about similar services — based on our legitimate interests in operating and growing our business (Article 6(1)(f)), or your consent (Article 6(1)(a)) where consent is required.

Where we rely on consent, you may withdraw it at any time; where we rely on legitimate interests, you may object as described in section 8.

4. Cookies and analytics

Our website uses cookies and similar technologies to make the site work, to remember your preferences (such as your chosen language) and to measure how the site is used so we can improve it. Strictly necessary cookies are always active; non-essential cookies (for example, analytics) are only used where permitted and, where required, on the basis of your consent.

You can control or delete cookies through your browser settings. Blocking some cookies may affect how parts of the site function.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers ("processors") who help us run our business, and only as necessary: cloud hosting and content-delivery providers; email and messaging providers that deliver enquiry notifications; payment processors (for example, Stripe) when you make a payment; analytics providers; and our professional advisers (such as accountants and lawyers).

These providers are bound by contracts that require them to protect your data and to use it only on our instructions. We may also disclose data where we are legally required to do so, or to establish, exercise or defend legal claims.

6. International transfers

Some of our providers may process your data outside the European Economic Area (EEA). Where that happens, we take steps to ensure an appropriate level of protection — for example, by relying on the European Commission's Standard Contractual Clauses or an adequacy decision — as required by the GDPR.

7. How long we keep your data

We keep enquiry and lead details for up to 24 months from our last contact with you, so we can follow up and keep an accurate record. Where you become a client, we keep contract and project records for the duration of our relationship and afterwards for as long as necessary to comply with tax, accounting and legal obligations (typically 10 years for accounting records), after which we delete or anonymise them. Analytics data is retained in aggregate form.

8. Your rights

Subject to the conditions in the GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing (including to direct marketing); receive your data in a portable format; and withdraw any consent you have given.

To exercise any of these rights, contact us using the details in section 12. We will respond within one month. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with a supervisory authority — in Lithuania, the State Data Protection Inspectorate (VDAI) — or with the authority in your country of residence.

9. How we protect your data

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration. These include encrypted connections (HTTPS/TLS), access controls, and working only with reputable, contractually bound service providers. No method of transmission or storage is perfectly secure, but we review our measures regularly.

10. Children

Our website and Services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date above shows when it was last revised. Material changes will be communicated on our website where appropriate.

12. How to contact us

For any question about this policy, or to exercise your rights, email us at a95201697@gmail.com or use our contact form. If you are not satisfied with our response, you may complain to the State Data Protection Inspectorate of the Republic of Lithuania (vdai.lrv.lt) or to your local supervisory authority.