Privacy
UAB Silotech Privacy Policy
Effective date: 2026-08-31 . Version: 2026-08-31.
1. General provisions
1.1. This privacy policy (the Policy) sets out how UAB Silotech processes personal data when providing its services and administering the website, and explains data subjects' rights and how to exercise them.
1.2. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, GDPR), the Republic of Lithuania Law on Legal Protection of Personal Data, the Republic of Lithuania Law on Electronic Communications and other applicable legislation.
1.3. By using our services or website, you confirm that you have read this Policy. The Policy is publicly available on the website and is presented when ordering or registering. We may update it periodically; the current version is always published on the website.
2. Definitions
2.1. Company / we: UAB Silotech (see Section 3).
2.2. GDPR: General Data Protection Regulation (EU) 2016/679.
2.3. Personal data: any information relating to an identified or identifiable natural person.
2.4. Data subject / you: a natural person whose personal data we process, such as a customer representative, contact person or training participant.
2.5. Processing: any operation performed on personal data, including collection, storage, use, transfer and deletion.
2.6. Controller: a person who determines the purposes and means of processing.
2.7. Processor: a person who processes data on behalf of and under the instructions of the controller.
2.8. Customer: a legal entity to which the Company provides services.
2.9. Services: services provided by the Company, including AI literacy training, document generation and related services.
2.10. Website: websites operated by the Company, including nebedirbam.lt.
3. Data controller
3.1. The controller of your personal data is:
UAB Silotech
Company code: 306971572
Address: Ateities g. 2, Pakrovų k., LT-33211 Molėtų r., Lithuania
Email: privacy@nebedirbam.lt
3.2. No data protection officer has been appointed, as the Company is not required to appoint one under GDPR Article 37. For any questions about personal data processing or exercising your rights, contact privacy@nebedirbam.lt.
4. What data we process, for what purposes and on what legal basis
4.1. We process personal data only for specific, clearly defined and lawful purposes, and no more data than necessary to achieve those purposes:
Entering into and performing a contract (including pre-contractual steps: placing an order, completing the questionnaire, providing the service, preparing and delivering documents)
Legal basis: Performance of a contract and pre-contractual steps (GDPR Article 6(1)(b))
Scope of data processed: Legal entity name and code; representative's first name, surname and role; contact email; telephone number; registered address; questionnaire answers (AI tools used, employee count, business sector); payment data (processed through Stripe; we do not store card details); AI literacy training participants' data (first name, surname, email, knowledge check result, completion certificate number; the customer provides this data about its employees); service-related emails (such as form completion reminders and document delivery); and other data necessary to provide services and enter into or perform the contract.
Security and enforcement of refund conditions
Legal basis: Performance of a contract (GDPR Article 6(1)(b)) and compliance with a legal obligation (GDPR Article 6(1)(c))
Scope of data processed: Technical data: IP address, browser parameters, download date and time. Recorded only when documents are downloaded, not for marketing analytics.
Accounting and compliance with legal obligations
Legal basis: Compliance with a legal obligation (GDPR Article 6(1)(c))
Scope of data processed: Data in accounting and tax documents: legal entity name, code, address, settlement and payment data, and other data required by law.
Managing enquiries and providing responses
Legal basis: Pre-contractual steps or performance of a contract (GDPR Article 6(1)(b)); where an enquiry is unrelated to a current or prospective contract: consent (GDPR Article 6(1)(a))
Scope of data processed: Legal entity name and code; representative's first name, surname and role; contact email; telephone number; registered address; enquiries submitted on the website, letters, emails and other communications and their content.
Direct marketing (see Section 5)
Legal basis: Consent (GDPR Article 6(1)(a)); the exceptions in Article 81 of the Law on Electronic Communications apply to marketing similar services to existing customers and to legal entities
Scope of data processed: Contact data: legal entity name, representative's first name and surname, email.
4.2. Source of data. We obtain personal data directly from you (the customer) or from data supplied by the customer, for example when the customer provides training participant data about its employees. We do not generally collect data from other sources.
4.3. Requirement to provide data. Data necessary to enter into and perform the contract and comply with legal obligations must be provided; otherwise, we cannot provide the services or properly perform the contract. Providing other data, such as for direct marketing, is voluntary and does not affect service provision.
4.4. AI literacy training participant data. When organising training and issuing certificates, the Company acts as a processor of participants' (the customer's employees') data, following the instructions of the customer as controller. These participants must receive information about the processing of their data from their employer (the customer). The customer confirms that it has a legal basis for transferring this data and has properly informed its employees.
4.5. Special category and children's data. We do not process special category (sensitive) personal data. Services are intended for legal entities.
4.6. Automated decision-making. The Company does not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
5. Processing personal data for direct marketing
5.1. If you are our customer, we may use your contact data to market similar services directly, provided you did not initially object to this use, and we give you a clear, free and easily exercisable opportunity to object or opt out.
5.2. If you are a legal entity, we may use your contact data for direct marketing, giving you a clear, free and easily exercisable opportunity to object or opt out of this use.
5.3. In all other cases, we may use your contact data for direct marketing only with your prior consent.
5.4. We provide a clear, free and easily exercisable opportunity to withdraw consent or opt out of direct marketing at any time by emailing privacy@nebedirbam.lt or using the unsubscribe link in the message. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
5.5. Emails, including informational messages in your account, and calls relating to the performance of contracts are not considered direct marketing.
6. Retention periods
6.1. We retain personal data no longer than necessary for the purposes for which it is processed, or as required by law:
6.1.1. customer contact and contract performance data: 3 years from the last contact;
6.1.2. accounting data: 10 years, as required by Lithuanian accounting legislation;
6.1.3. training participant data and completion certificates: for as long as the customer's service access remains valid (up to 3 years), so certificates can be downloaded again.
6.2. After the retention period, personal data is securely and irreversibly deleted or anonymised.
6.3. In certain cases, your personal data may be retained for longer if:
6.3.1. necessary to defend against demands, claims or legal proceedings and exercise our rights;
6.3.2. we have reasonable suspicions of unlawful activity under investigation;
6.3.3. personal data is necessary to resolve a dispute or complaint properly;
6.3.4. other grounds provided by law exist.
7. Recipients and processors of personal data
7.1. In its operations, the Company may engage processors, such as payment, data storage or IT service providers. Only some of your personal data is transferred to these persons, and only to the extent and in the circumstances necessary to provide their services.
7.2. Main processors and subprocessors:
- Stripe Payments Europe, Limited (Ireland, EU): payment processing; personal data may be transferred to its affiliate Stripe, LLC (USA) to provide the service (see Section 8.1);
- Supabase: storage of questionnaire data submitted through the nebedirbam.lt form (EU region);
- Scaleway: infrastructure for AI models used to generate documents (EU region, France).
7.3. Processing by all listed processors is governed by obligations in their standard data processing agreements (DPAs), which meet GDPR Article 28 requirements and apply automatically when their services are used.
7.4. Your personal data may also be provided to:
7.4.1. public authorities and institutions, courts or other persons where required by law or necessary to protect the Company's legitimate interests;
7.4.2. legal, accounting or other professional service providers engaged by the Company;
7.4.3. other third parties involved in providing the Company's services and/or having a legal basis to receive the data.
8. Transfers outside the EU / EEA
8.1. Some processors listed in Section 7.2 (Stripe, LLC, an affiliate of Stripe Payments Europe, Limited) are established outside the European Union / European Economic Area (EEA), in the USA. These providers incorporate European Commission standard contractual clauses in their standard data processing agreements (GDPR Article 46; Commission Implementing Decision (EU) 2021/914), and some are also certified under the EU-US Data Privacy Framework (GDPR Article 45). Supabase and Scaleway data is stored in the EU region.
8.2. For more information about the safeguards applied, email privacy@nebedirbam.lt.
9. Data security
9.1. We implement appropriate organisational and technical security measures to protect your personal data against unauthorised access, disclosure, loss or destruction (GDPR Article 32). We restrict data access, use secure and reliable service providers, and encrypt data in transit.
10. Your rights
10.1. As a data subject, you have the following rights under the GDPR:
10.1.1. access your personal data and obtain information about the data we hold about you (GDPR Article 15);
10.1.2. request rectification of inaccurate or incomplete data (GDPR Article 16);
10.1.3. request erasure of data (the right to be forgotten) (GDPR Article 17);
10.1.4. restrict processing (GDPR Article 18);
10.1.5. data portability: in certain cases, where data is processed by automated means on the basis of consent or a contract, receive your data in a structured, commonly used and machine-readable format (GDPR Article 20);
10.1.6. object to processing for direct marketing purposes (GDPR Article 21);
10.1.7. withdraw consent at any time without affecting the lawfulness of processing before withdrawal (GDPR Article 7(3)).
10.2. Send requests to exercise your rights to privacy@nebedirbam.lt . We will respond within one month of receiving the request; this period may be extended where necessary in accordance with the GDPR. We may ask you to verify your identity before fulfilling the request.
10.3. If you believe your personal data is being processed improperly, you may lodge a complaint with the supervisory authority: the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius; vdai.lrv.lt).
11. Cookies
11.1. We use only essential technical cookies that are critical to the main service function: authenticating users and maintaining sign-in sessions. This is the session cookie set by our processor Supabase; it is set only when a user signs in and is used solely to keep the user signed in while browsing the website. It is not set for visitors who have not signed in.
11.2. Payments take place directly on Stripe's payment page in a separate Stripe-controlled environment (domain), not on our website. Any cookies set by Stripe during this process belong to Stripe's domain, not ours. Stripe is responsible as a separate controller for these cookies and the related information obligations on its payment page.
11.3. We do not use analytics, marketing or third-party tracking cookies on our website. As the cookie in Section 11.1 is strictly necessary for a service expressly requested by the user (sign-in), the exception in Article 73(4) of the Republic of Lithuania Law on Electronic Communications (version effective from 1 July 2026) applies, corresponding to the second sentence of Article 5(3) of Directive 2002/58/EC concerning technical storage necessary to provide an information society service expressly requested by the subscriber or user. Separate consent for this cookie is therefore not required.
11.4. The app_locale cookie remembers the language you expressly choose for up to 12 months. It is not used for tracking or advertising.
12. Final provisions
12.1. This Policy may be updated. We will publish material changes on the website and notify you separately where necessary.
12.2. For questions about this Policy or personal data processing, email privacy@nebedirbam.lt.