Privacy Policy

JUSMES, UAB. Version 2.1, effective from 14 October 2026. Lietuviškai

This policy explains what personal data we process, why, how long we keep it and what rights you have. It covers all activities of JUSMES, UAB:

If the Lithuanian and English versions differ, the Lithuanian version prevails.

1. Data controller

JUSMES, UAB, company code 302462186, registered address Fabijoniškių g. 3A-76, LT-07130 Vilnius, Lithuania, phone +370 698 41918.

For privacy questions, write to [email protected]. For data received from the Register Centre (section 2), you may also write to [email protected].

We have not appointed a data protection officer, as our activities do not fall under Article 37(1) of the GDPR.

2. Data we receive from the Register Centre

This section is for managers, accountants and other persons whose data appear in the financial statements of public and private limited companies (AB and UAB). We do not receive these data from you directly, so we provide this information under Article 14 of the GDPR.

Why we receive these documents

We are building EVA, an economic analysis system that compares a client's financial indicators with those of companies in the same industry. For this purpose we order selected annual financial statements of AB and UAB companies and short company extracts from the Register of Legal Entities (JAR), managed by the state enterprise Registrų centras.

We do not need personal data for this purpose. We process them only because they are part of the document that the Register Centre supplies in full.

Personal data that may be included

Source Personal data
Financial statements Name, surname, position and signature of the manager and of the person responsible for accounting
Explanatory notes Information on remuneration paid to management and on related party transactions, if disclosed by the company
JAR short extract Company phone number or email address, if linked to a natural person

The JAR extracts we receive do not contain the manager's data.

We process the data under Article 6(1)(f) of the GDPR (legitimate interest). Our interest is to provide companies with a well-founded assessment of their economic condition. The documents are public under Article 2.71 of the Civil Code of the Republic of Lithuania, and we receive them under a data provision agreement with the Register Centre.

What we do and do not do with them

We calculate financial indicators from the document. We do not extract personal data from it, do not systematise it, do not link it with other data and do not transfer it to our database.

Clients see only the calculated indicators, and comparison companies are shown under pseudonyms ("Competitor 1" etc.). We do not disclose personal data to clients, do not resell the documents and do not publish them. We do not make automated decisions about individuals or create profiles.

Retention

Financial statements are deleted automatically no later than 90 days after receipt. They may remain in backups for up to 30 more days.

From JAR extracts we keep only the company code, name, legal form, status and dates. We do not keep phone numbers or email addresses.

Only calculated financial indicators are kept indefinitely. They contain no personal data.

Location and security

These data are stored on Hetzner Online GmbH servers in Germany, with backups in encrypted storage in Lithuania. We do not transfer them outside the European Economic Area.

Disks are encrypted, data are transmitted over encrypted connections (TLS 1.3), and only two authorised employees can access the servers, from specified IP addresses. Access logs are kept for two years.

3. Clients

EVA clients

We process the name, surname, position, email and phone number of client contact persons, as well as the company financial data provided by the client. Legal basis: contract with the client (Article 6(1)(b) of the GDPR).

IT services (IT-Vektorius)

We process the name, surname, position, email, phone number and correspondence of client contact persons. Legal basis: contract with the client (Article 6(1)(b) of the GDPR).

When we administer a client's servers, email, cloud services or other systems, they may contain data of the client's employees, customers and other persons. The client is the controller of these data and we act as a processor (Article 28 of the GDPR). In that case:

These commitments and confidentiality terms are part of our contracts with clients. At the client's request we also sign a separate data processing agreement. If your data are in a client's system, please contact that company first.

Chinese language lessons

We process students' contact details (name, surname, email, phone), lesson and payment data. If a student is a minor, we receive the data from a parent or guardian and communicate with them. Legal basis: the contract for lessons (Article 6(1)(b) of the GDPR) and our accounting obligation (Article 6(1)(c)).

How long we keep client data

Contact details and correspondence are kept for the duration of the contract and afterwards as long as needed to perform the contract, resolve possible claims and meet accounting requirements. Invoices and other accounting documents are kept for the period required by Lithuanian law (Law on Accounting, General Index of Document Retention Periods).

4. Websites and cookies

jusmes.lt

jusmes.lt uses no cookies, collects no visitor statistics and has no forms. It is hosted by Cloudflare. When you open a page, Cloudflare processes technical data (IP address, browser type, request time) to deliver the page and protect it from attacks. Legal basis: legitimate interest in keeping the website running and secure (Article 6(1)(f) of the GDPR). We do not collect or store these data separately.

it-vektorius.lt

it-vektorius.lt uses analytics and advertising cookies (Google Analytics 4, Google Ads), cookieless Cloudflare Web Analytics and IT security self-assessment tests. The data collected there, retention and cookies are described in that site's privacy policy and cookie policy (in Lithuanian).

nihao.lt

nihao.lt is the website of our premium Chinese language programme for children. It uses no cookies. Through its conversation form we receive the parent's name, email address, phone number (if given), the child's age group, preferred format, message and how they found us. We use this only to reply and prepare a proposal. Legal basis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b)). If no contract follows, we delete the enquiry 12 months after the last email. More: nihao.lt privacy policy (in Lithuanian).

kinukalba.lt

kinukalba.lt redirects to our Facebook page, where Meta's privacy policy applies. If you write to us on Facebook or Messenger, we use your name and message only to reply and arrange lessons.

5. IT Vektorius LinkedIn Publisher

When you sign in to the App with your LinkedIn account and authorise access, we receive your first name, last name, email address, LinkedIn identifier and profile photo. We also process technical data necessary for the operation and security of the App: IP address, browser and device information, timestamps and error logs.

LinkedIn profile data are collected only when you choose to sign in and authorise access through LinkedIn's authorisation flow, not merely because you open a page. The App requests only the permissions it needs to function.

We use the data to authenticate you, create and manage your account, connect your LinkedIn account, provide the App's functions, contact you about the service, support or security, and protect the App from misuse. Legal bases: contract (providing the App), your consent (connecting your LinkedIn account), legal obligation, and legitimate interests (security, fraud prevention, diagnostics, legal defence).

Retention:

We keep data longer only where needed to investigate a security incident, prevent fraud or comply with the law. The App is not intended for children.

6. Who we share data with

We do not sell personal data. Only the following service providers process it, and only as needed for their service:

We may also disclose data to public authorities where required by law (e.g. accounting data to the State Tax Inspectorate).

Data from the Register Centre stay within the European Economic Area (section 2). Google and Cloudflare are US companies, so email and website data may also be processed outside the EEA. In that case the safeguards of Chapter V of the GDPR apply: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. Security

We use technical and organisational measures to protect data against loss, alteration and unauthorised access: encrypted connections, access limited to authorised persons, backups and access logs. Measures for the EVA servers are described in section 2.

We do not make automated decisions that have legal effects on you and do not create profiles.

8. Your rights

You have the right to:

If we receive a justified objection regarding data from the Register Centre, we delete the documents relating to you without delay.

Send requests to [email protected] (for Register Centre data, also [email protected]). We reply within one month of receipt. If a request is complex, we may extend this period, but we will tell you within the same month.

If you believe we process your data unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, LT-10312 Vilnius, [email protected], vdai.lrv.lt).

9. Changes

We publish any updated policy on this page with a new version number and date.